CVE-2024-26990 (GCVE-0-2024-26990)

Vulnerability from cvelistv5 – Published: 2024-05-01 05:27 – Updated: 2026-08-05 11:28
VLAI
Title
KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status Check kvm_mmu_page_ad_need_write_protect() when deciding whether to write-protect or clear D-bits on TDP MMU SPTEs, so that the TDP MMU accounts for any role-specific reasons for disabling D-bit dirty logging. Specifically, TDP MMU SPTEs must be write-protected when the TDP MMU is being used to run an L2 (i.e. L1 has disabled EPT) and PML is enabled. KVM always disables PML when running L2, even when L1 and L2 GPAs are in the some domain, so failing to write-protect TDP MMU SPTEs will cause writes made by L2 to not be reflected in the dirty log. [sean: massage shortlog and changelog, tweak ternary op formatting]
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 5982a5392663b30f57ee90b0372c19a7e9cb655a , < cdf811a937471af2d1facdf8ae80e5e68096f1ed (git)
Affected: 5982a5392663b30f57ee90b0372c19a7e9cb655a , < e20bff0f1b2de9cfe303dd35ff46470104a87404 (git)
Affected: 5982a5392663b30f57ee90b0372c19a7e9cb655a , < 2673dfb591a359c75080dd5af3da484b89320d22 (git)
Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.6.29 , ≤ 6.6.* (semver)
Unaffected: 6.8.8 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26990",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-14T20:04:24.835393Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-14T20:04:34.681Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:15:35.930Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cdf811a937471af2d1facdf8ae80e5e68096f1ed"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e20bff0f1b2de9cfe303dd35ff46470104a87404"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2673dfb591a359c75080dd5af3da484b89320d22"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/tdp_mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cdf811a937471af2d1facdf8ae80e5e68096f1ed",
              "status": "affected",
              "version": "5982a5392663b30f57ee90b0372c19a7e9cb655a",
              "versionType": "git"
            },
            {
              "lessThan": "e20bff0f1b2de9cfe303dd35ff46470104a87404",
              "status": "affected",
              "version": "5982a5392663b30f57ee90b0372c19a7e9cb655a",
              "versionType": "git"
            },
            {
              "lessThan": "2673dfb591a359c75080dd5af3da484b89320d22",
              "status": "affected",
              "version": "5982a5392663b30f57ee90b0372c19a7e9cb655a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/tdp_mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.29",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.8",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status\n\nCheck kvm_mmu_page_ad_need_write_protect() when deciding whether to\nwrite-protect or clear D-bits on TDP MMU SPTEs, so that the TDP MMU\naccounts for any role-specific reasons for disabling D-bit dirty logging.\n\nSpecifically, TDP MMU SPTEs must be write-protected when the TDP MMU is\nbeing used to run an L2 (i.e. L1 has disabled EPT) and PML is enabled.\nKVM always disables PML when running L2, even when L1 and L2 GPAs are in\nthe some domain, so failing to write-protect TDP MMU SPTEs will cause\nwrites made by L2 to not be reflected in the dirty log.\n\n[sean: massage shortlog and changelog, tweak ternary op formatting]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggering the flaw requires executing code in a VM on the affected host \u2014 VMLAUNCHing an L2 with EPT disabled via /dev/kvm \u2014 which is local code execution on the vulnerable component. No host-side network protocol handler reaches the TDP MMU dirty-logging paths.\nAC:L - The miss is unconditional and deterministic: any SPTE created under the guest_mode TDP root is WRPROT_ONLY, and the clearing path always chose the D-bit instead, with no race, timing window, or memory layout the attacker cannot influence. The guest chooses to run an L2 without EPT and can keep it running indefinitely, and dirty logging is a routine, recurring host operation (migration, dirty ring, framebuffer); syzkaller reproduced it from an ordinary local process.\nPR:L - The attacker only needs the ability to create and run a VM \u2014 /dev/kvm access via the kvm group, or simply being the tenant of a guest on a virtualization host \u2014 which is a low-privileged position on the vulnerable component. No host root, CAP_SYS_ADMIN, or module parameter change is required since nested VMX, PML, and the TDP MMU are all enabled by default.\nUI:N - Dirty logging is turned on by the orchestrator or device model automatically (maintenance/rebalancing live migrations, dirty-ring checkpointing, VGA framebuffer tracking) with no human in the loop. Once logging is active the guest\u0027s own L2 execution loses the writes with no cooperation from any other user.\nS:C - The defect is in the host kernel\u0027s KVM module, but the damage is realized in a different security authority \u2014 the guest VM\u0027s memory, governed by the guest OS \u2014 and lets guest activity escape the host hypervisor\u0027s dirty-tracking ABI entirely. A low-privileged guest context causes corruption of guest-kernel and other-guest-process memory it could never write directly, crossing the host/guest boundary.\nC:H - Every page written by L2 during the logging window is omitted from the dirty bitmap, so the migrated VM retains stale contents for those pages \u2014 including guest page tables whose rolled-back PTEs still map physical frames since reassigned to other processes or the guest kernel, yielding an arbitrary-read window across intra-guest security boundaries. It also silently defeats any host-side introspection, forensics, or checkpoint mechanism that relies on KVM dirty tracking to observe guest writes.\nI:H - Writes the guest architecturally committed are silently reverted on the destination VM; for paging structures and kernel data this is a rollback of mapping and permission state, credential structures, reference counts, and lock words, amounting to an arbitrary-write primitive over memory belonging to other processes and the kernel inside the VM. Unlike the emulated-atomic variant of this bug, the entire write stream of L2 is dropped, not a narrow subset.\nA:H - A VM resuming with inconsistent memory \u2014 stale page tables or reverted kernel structures \u2014 panics, hangs, or corrupts its filesystem, taking down the whole VM and every workload on it, and the loss is unrecoverable once the source VM is discarded. Additionally the guest-triggerable KVM_MMU_WARN_ON in clear_dirty_gfn_range()/clear_dirty_pt_masked() (the syzbot-reported symptom) produces a kernel WARN that is fatal on hosts running panic_on_warn."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:28:51.630Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cdf811a937471af2d1facdf8ae80e5e68096f1ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/e20bff0f1b2de9cfe303dd35ff46470104a87404"
        },
        {
          "url": "https://git.kernel.org/stable/c/2673dfb591a359c75080dd5af3da484b89320d22"
        }
      ],
      "title": "KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26990",
    "datePublished": "2024-05-01T05:27:48.810Z",
    "dateReserved": "2024-02-19T14:20:24.205Z",
    "dateUpdated": "2026-08-05T11:28:51.630Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26990",
      "date": "2026-08-05",
      "epss": "0.00238",
      "percentile": "0.14901"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status\\n\\nCheck kvm_mmu_page_ad_need_write_protect() when deciding whether to\\nwrite-protect or clear D-bits on TDP MMU SPTEs, so that the TDP MMU\\naccounts for any role-specific reasons for disabling D-bit dirty logging.\\n\\nSpecifically, TDP MMU SPTEs must be write-protected when the TDP MMU is\\nbeing used to run an L2 (i.e. L1 has disabled EPT) and PML is enabled.\\nKVM always disables PML when running L2, even when L1 and L2 GPAs are in\\nthe some domain, so failing to write-protect TDP MMU SPTEs will cause\\nwrites made by L2 to not be reflected in the dirty log.\\n\\n[sean: massage shortlog and changelog, tweak ternary op formatting]\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: x86/mmu: Proteger contra escritura los SPTE L2 en la MMU TDP al borrar el estado sucio. Verifique kvm_mmu_page_ad_need_write_protect() cuando decida si desea proteger contra escritura o borrar los bits D en los SPTE de la MMU TDP. , de modo que la MMU TDP tenga en cuenta cualquier motivo espec\\u00edfico de la funci\\u00f3n para deshabilitar el registro sucio de bits D. Espec\\u00edficamente, los SPTE de TDP MMU deben estar protegidos contra escritura cuando la TDP MMU se utiliza para ejecutar un L2 (es decir, L1 tiene EPT deshabilitado) y PML est\\u00e1 habilitado. KVM siempre desactiva PML cuando se ejecuta L2, incluso cuando los GPA L1 y L2 est\\u00e1n en alg\\u00fan dominio, por lo que si no se protegen contra escritura los SPTE TDP MMU, las escrituras realizadas por L2 no se reflejar\\u00e1n en el registro sucio. [sean: masajear el registro corto y el registro de cambios, modificar el formato de operaci\\u00f3n ternario]\"}]",
      "id": "CVE-2024-26990",
      "lastModified": "2024-11-21T09:03:34.077",
      "published": "2024-05-01T06:15:16.673",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/2673dfb591a359c75080dd5af3da484b89320d22\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/cdf811a937471af2d1facdf8ae80e5e68096f1ed\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/e20bff0f1b2de9cfe303dd35ff46470104a87404\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/2673dfb591a359c75080dd5af3da484b89320d22\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/cdf811a937471af2d1facdf8ae80e5e68096f1ed\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/e20bff0f1b2de9cfe303dd35ff46470104a87404\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2024-09-11T00:00:00.000Z",
      "cve": "CVE-2024-26990",
      "id": "msrc_CVE-2024-26990",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-26990.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26990\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-01T06:15:16.673\",\"lastModified\":\"2026-08-04T11:17:31.150\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status\\n\\nCheck kvm_mmu_page_ad_need_write_protect() when deciding whether to\\nwrite-protect or clear D-bits on TDP MMU SPTEs, so that the TDP MMU\\naccounts for any role-specific reasons for disabling D-bit dirty logging.\\n\\nSpecifically, TDP MMU SPTEs must be write-protected when the TDP MMU is\\nbeing used to run an L2 (i.e. L1 has disabled EPT) and PML is enabled.\\nKVM always disables PML when running L2, even when L1 and L2 GPAs are in\\nthe some domain, so failing to write-protect TDP MMU SPTEs will cause\\nwrites made by L2 to not be reflected in the dirty log.\\n\\n[sean: massage shortlog and changelog, tweak ternary op formatting]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: x86/mmu: Proteger contra escritura los SPTE L2 en la MMU TDP al borrar el estado sucio. Verifique kvm_mmu_page_ad_need_write_protect() cuando decida si desea proteger contra escritura o borrar los bits D en los SPTE de la MMU TDP. , de modo que la MMU TDP tenga en cuenta cualquier motivo espec\u00edfico de la funci\u00f3n para deshabilitar el registro sucio de bits D. Espec\u00edficamente, los SPTE de TDP MMU deben estar protegidos contra escritura cuando la TDP MMU se utiliza para ejecutar un L2 (es decir, L1 tiene EPT deshabilitado) y PML est\u00e1 habilitado. KVM siempre desactiva PML cuando se ejecuta L2, incluso cuando los GPA L1 y L2 est\u00e1n en alg\u00fan dominio, por lo que si no se protegen contra escritura los SPTE TDP MMU, las escrituras realizadas por L2 no se reflejar\u00e1n en el registro sucio. [sean: masajear el registro corto y el registro de cambios, modificar el formato de operaci\u00f3n ternario]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/kvm/mmu/tdp_mmu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5982a5392663b30f57ee90b0372c19a7e9cb655a\",\"lessThan\":\"cdf811a937471af2d1facdf8ae80e5e68096f1ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5982a5392663b30f57ee90b0372c19a7e9cb655a\",\"lessThan\":\"e20bff0f1b2de9cfe303dd35ff46470104a87404\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5982a5392663b30f57ee90b0372c19a7e9cb655a\",\"lessThan\":\"2673dfb591a359c75080dd5af3da484b89320d22\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/kvm/mmu/tdp_mmu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.29\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.8\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-14T20:04:24.835393Z\",\"id\":\"CVE-2024-26990\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4\",\"versionEndExcluding\":\"6.6.29\",\"matchCriteriaId\":\"EA36A678-0133-4EFB-B4BE-29C569825E2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.8\",\"matchCriteriaId\":\"673B3328-389D-41A4-9617-669298635262\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A06B2CCF-3F43-4FA9-8773-C83C3F5764B2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2673dfb591a359c75080dd5af3da484b89320d22\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cdf811a937471af2d1facdf8ae80e5e68096f1ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e20bff0f1b2de9cfe303dd35ff46470104a87404\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2673dfb591a359c75080dd5af3da484b89320d22\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cdf811a937471af2d1facdf8ae80e5e68096f1ed\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e20bff0f1b2de9cfe303dd35ff46470104a87404\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:49:08+00:00",
      "cve": "CVE-2024-26990",
      "id": "CVE-2024-26990",
      "initial_release_date": "2024-05-01T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "98",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26990.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-26T00:05:32Z",
      "cve": "CVE-2024-26990",
      "id": "CVE-2024-26990",
      "initial_release_date": "2024-05-03T02:09:42Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "312",
      "product_status:recommended": "358",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26990",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26990.json",
      "version": "74"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/cdf811a937471af2d1facdf8ae80e5e68096f1ed\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e20bff0f1b2de9cfe303dd35ff46470104a87404\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2673dfb591a359c75080dd5af3da484b89320d22\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T17:15:35.930Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26990\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-14T20:04:24.835393Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-14T20:04:31.930Z\"}}], \"cna\": {\"title\": \"KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Triggering the flaw requires executing code in a VM on the affected host \\u2014 VMLAUNCHing an L2 with EPT disabled via /dev/kvm \\u2014 which is local code execution on the vulnerable component. No host-side network protocol handler reaches the TDP MMU dirty-logging paths.\\nAC:L - The miss is unconditional and deterministic: any SPTE created under the guest_mode TDP root is WRPROT_ONLY, and the clearing path always chose the D-bit instead, with no race, timing window, or memory layout the attacker cannot influence. The guest chooses to run an L2 without EPT and can keep it running indefinitely, and dirty logging is a routine, recurring host operation (migration, dirty ring, framebuffer); syzkaller reproduced it from an ordinary local process.\\nPR:L - The attacker only needs the ability to create and run a VM \\u2014 /dev/kvm access via the kvm group, or simply being the tenant of a guest on a virtualization host \\u2014 which is a low-privileged position on the vulnerable component. No host root, CAP_SYS_ADMIN, or module parameter change is required since nested VMX, PML, and the TDP MMU are all enabled by default.\\nUI:N - Dirty logging is turned on by the orchestrator or device model automatically (maintenance/rebalancing live migrations, dirty-ring checkpointing, VGA framebuffer tracking) with no human in the loop. Once logging is active the guest\u0027s own L2 execution loses the writes with no cooperation from any other user.\\nS:C - The defect is in the host kernel\u0027s KVM module, but the damage is realized in a different security authority \\u2014 the guest VM\u0027s memory, governed by the guest OS \\u2014 and lets guest activity escape the host hypervisor\u0027s dirty-tracking ABI entirely. A low-privileged guest context causes corruption of guest-kernel and other-guest-process memory it could never write directly, crossing the host/guest boundary.\\nC:H - Every page written by L2 during the logging window is omitted from the dirty bitmap, so the migrated VM retains stale contents for those pages \\u2014 including guest page tables whose rolled-back PTEs still map physical frames since reassigned to other processes or the guest kernel, yielding an arbitrary-read window across intra-guest security boundaries. It also silently defeats any host-side introspection, forensics, or checkpoint mechanism that relies on KVM dirty tracking to observe guest writes.\\nI:H - Writes the guest architecturally committed are silently reverted on the destination VM; for paging structures and kernel data this is a rollback of mapping and permission state, credential structures, reference counts, and lock words, amounting to an arbitrary-write primitive over memory belonging to other processes and the kernel inside the VM. Unlike the emulated-atomic variant of this bug, the entire write stream of L2 is dropped, not a narrow subset.\\nA:H - A VM resuming with inconsistent memory \\u2014 stale page tables or reverted kernel structures \\u2014 panics, hangs, or corrupts its filesystem, taking down the whole VM and every workload on it, and the loss is unrecoverable once the source VM is discarded. Additionally the guest-triggerable KVM_MMU_WARN_ON in clear_dirty_gfn_range()/clear_dirty_pt_masked() (the syzbot-reported symptom) produces a kernel WARN that is fatal on hosts running panic_on_warn.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5982a5392663b30f57ee90b0372c19a7e9cb655a\", \"lessThan\": \"cdf811a937471af2d1facdf8ae80e5e68096f1ed\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5982a5392663b30f57ee90b0372c19a7e9cb655a\", \"lessThan\": \"e20bff0f1b2de9cfe303dd35ff46470104a87404\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5982a5392663b30f57ee90b0372c19a7e9cb655a\", \"lessThan\": \"2673dfb591a359c75080dd5af3da484b89320d22\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/x86/kvm/mmu/tdp_mmu.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.29\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/x86/kvm/mmu/tdp_mmu.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/cdf811a937471af2d1facdf8ae80e5e68096f1ed\"}, {\"url\": \"https://git.kernel.org/stable/c/e20bff0f1b2de9cfe303dd35ff46470104a87404\"}, {\"url\": \"https://git.kernel.org/stable/c/2673dfb591a359c75080dd5af3da484b89320d22\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status\\n\\nCheck kvm_mmu_page_ad_need_write_protect() when deciding whether to\\nwrite-protect or clear D-bits on TDP MMU SPTEs, so that the TDP MMU\\naccounts for any role-specific reasons for disabling D-bit dirty logging.\\n\\nSpecifically, TDP MMU SPTEs must be write-protected when the TDP MMU is\\nbeing used to run an L2 (i.e. L1 has disabled EPT) and PML is enabled.\\nKVM always disables PML when running L2, even when L1 and L2 GPAs are in\\nthe some domain, so failing to write-protect TDP MMU SPTEs will cause\\nwrites made by L2 to not be reflected in the dirty log.\\n\\n[sean: massage shortlog and changelog, tweak ternary op formatting]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.29\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.8\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:28:51.630Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26990\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:28:51.630Z\", \"dateReserved\": \"2024-02-19T14:20:24.205Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-01T05:27:48.810Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.