CVE-2024-40989 (GCVE-0-2024-40989)

Vulnerability from cvelistv5 – Published: 2024-07-12 12:37 – Updated: 2026-08-05 11:34
VLAI
Title
KVM: arm64: Disassociate vcpus from redistributor region on teardown
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Disassociate vcpus from redistributor region on teardown When tearing down a redistributor region, make sure we don't have any dangling pointer to that region stored in a vcpu.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: e5a35635464bc5304674b84ea42615a3fd0bd949 , < 68df4fc449fcc24347209e500ce26d5816705a77 (git)
Affected: e5a35635464bc5304674b84ea42615a3fd0bd949 , < 48bb62859d47c5c4197a8c01128d0fa4f46ee58c (git)
Affected: e5a35635464bc5304674b84ea42615a3fd0bd949 , < 152b4123f21e6aff31cea01158176ad96a999c76 (git)
Affected: e5a35635464bc5304674b84ea42615a3fd0bd949 , < 0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8 (git)
Create a notification for this product.
Linux Linux Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 6.1.96 , ≤ 6.1.* (semver)
Unaffected: 6.6.36 , ≤ 6.6.* (semver)
Unaffected: 6.9.7 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:58:53.765Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/68df4fc449fcc24347209e500ce26d5816705a77"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/48bb62859d47c5c4197a8c01128d0fa4f46ee58c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/152b4123f21e6aff31cea01158176ad96a999c76"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40989",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:01:54.595799Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:20.480Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/vgic/vgic-init.c",
            "arch/arm64/kvm/vgic/vgic-mmio-v3.c",
            "arch/arm64/kvm/vgic/vgic.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "68df4fc449fcc24347209e500ce26d5816705a77",
              "status": "affected",
              "version": "e5a35635464bc5304674b84ea42615a3fd0bd949",
              "versionType": "git"
            },
            {
              "lessThan": "48bb62859d47c5c4197a8c01128d0fa4f46ee58c",
              "status": "affected",
              "version": "e5a35635464bc5304674b84ea42615a3fd0bd949",
              "versionType": "git"
            },
            {
              "lessThan": "152b4123f21e6aff31cea01158176ad96a999c76",
              "status": "affected",
              "version": "e5a35635464bc5304674b84ea42615a3fd0bd949",
              "versionType": "git"
            },
            {
              "lessThan": "0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8",
              "status": "affected",
              "version": "e5a35635464bc5304674b84ea42615a3fd0bd949",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/vgic/vgic-init.c",
            "arch/arm64/kvm/vgic/vgic-mmio-v3.c",
            "arch/arm64/kvm/vgic/vgic.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.96",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.36",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.7",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Disassociate vcpus from redistributor region on teardown\n\nWhen tearing down a redistributor region, make sure we don\u0027t have\nany dangling pointer to that region stored in a vcpu."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The entire attack is a sequence of ioctls on /dev/kvm and the resulting VM/vCPU/vgic-device file descriptors (KVM_CREATE_DEVICE, KVM_SET_DEVICE_ATTR, KVM_RUN, KVM_GET_DEVICE_ATTR); no network, adjacent-network, or physical path reaches arch/arm64/kvm/vgic.\nAC:L - No race and no unpredictable state is involved \u2014 the attacker deterministically forces the free (redist region with count \u003c nr_vcpus followed by a failing first KVM_RUN, or MMIO-bus exhaustion via ~1000 ioeventfds to make kvm_io_bus_register_dev return -ENOSPC), then re-inits the vgic and reads GICR_TYPER at will, with unlimited time to groom and spray the reclaimed kmalloc-cg-64 slot.\nPR:L - Creating a VM, a KVM_DEV_TYPE_ARM_VGIC_V3 device and vCPUs requires no capability at all \u2014 only the ability to open /dev/kvm, which is world-accessible (0666 udev rule) or kvm-group on mainstream distros and is exposed to unprivileged app-domain virtualization on Android/AVF.\nUI:N - The attacker performs the region setup, the failing KVM_RUN, the re-init and the GICR_TYPER read entirely within its own process; no victim action, mount, or file open is required.\nS:U - The free is only reachable from the host VMM process, not from guest code, so the attacker and the corrupted host kernel heap are in the same security authority \u2014 this is standard local kernel privilege escalation, not a guest-to-host escape.\nC:H - vgic_mmio_vcpu_rdist_is_last() dereferences a stale pointer into a freed, reclaimed kmalloc-cg-64 object, reading base/count/free_index from whatever heap data now occupies that slot; per kernel scoring guidance a use-after-free read of reclaimed slab memory is treated as High, and the resulting GICR_TYPER_LAST bit forms a repeatable oracle over sprayed heap contents.\nI:H - The bug leaves a permanently dangling kernel heap pointer in vcpu-\u003earch.vgic_cpu.rdreg that survives arbitrary reallocation of that slab object, which is the canonical memory-corruption primitive class; the stale dereference also feeds falsified redistributor topology into GICR_TYPER as seen by the guest and by the migration save/restore stream.\nA:H - Dereferencing freed slab memory produces a KASAN use-after-free splat (fatal under panic_on_warn) and can oops outright if the backing page has been returned to the allocator, and the attacker can re-trigger the GICR_TYPER read arbitrarily often."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:34:27.078Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/68df4fc449fcc24347209e500ce26d5816705a77"
        },
        {
          "url": "https://git.kernel.org/stable/c/48bb62859d47c5c4197a8c01128d0fa4f46ee58c"
        },
        {
          "url": "https://git.kernel.org/stable/c/152b4123f21e6aff31cea01158176ad96a999c76"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8"
        }
      ],
      "title": "KVM: arm64: Disassociate vcpus from redistributor region on teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40989",
    "datePublished": "2024-07-12T12:37:33.823Z",
    "dateReserved": "2024-07-12T12:17:45.605Z",
    "dateUpdated": "2026-08-05T11:34:27.078Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-40989",
      "date": "2026-08-05",
      "epss": "0.00299",
      "percentile": "0.22095"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: arm64: Disassociate vcpus from redistributor region on teardown\\n\\nWhen tearing down a redistributor region, make sure we don\u0027t have\\nany dangling pointer to that region stored in a vcpu.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: KVM: arm64: desasociar vcpus de la regi\\u00f3n del redistribuidor al desmantelar Al desmantelar una regi\\u00f3n de redistribuidor, aseg\\u00farese de que no tengamos ning\\u00fan puntero colgante a esa regi\\u00f3n almacenado en una vcpu.\"}]",
      "id": "CVE-2024-40989",
      "lastModified": "2024-11-21T09:32:00.963",
      "published": "2024-07-12T13:15:20.310",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/152b4123f21e6aff31cea01158176ad96a999c76\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/48bb62859d47c5c4197a8c01128d0fa4f46ee58c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/68df4fc449fcc24347209e500ce26d5816705a77\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/152b4123f21e6aff31cea01158176ad96a999c76\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/48bb62859d47c5c4197a8c01128d0fa4f46ee58c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/68df4fc449fcc24347209e500ce26d5816705a77\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T15:18:59.000Z",
      "cve": "CVE-2024-40989",
      "id": "msrc_CVE-2024-40989",
      "initial_release_date": "2024-07-01T07:00:00.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "KVM: arm64: Disassociate vcpus from redistributor region on teardown",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-40989.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-40989\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-12T13:15:20.310\",\"lastModified\":\"2026-08-04T11:19:13.230\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: arm64: Disassociate vcpus from redistributor region on teardown\\n\\nWhen tearing down a redistributor region, make sure we don\u0027t have\\nany dangling pointer to that region stored in a vcpu.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: KVM: arm64: desasociar vcpus de la regi\u00f3n del redistribuidor al desmantelar Al desmantelar una regi\u00f3n de redistribuidor, aseg\u00farese de que no tengamos ning\u00fan puntero colgante a esa regi\u00f3n almacenado en una vcpu.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/arm64/kvm/vgic/vgic-init.c\",\"arch/arm64/kvm/vgic/vgic-mmio-v3.c\",\"arch/arm64/kvm/vgic/vgic.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e5a35635464bc5304674b84ea42615a3fd0bd949\",\"lessThan\":\"68df4fc449fcc24347209e500ce26d5816705a77\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e5a35635464bc5304674b84ea42615a3fd0bd949\",\"lessThan\":\"48bb62859d47c5c4197a8c01128d0fa4f46ee58c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e5a35635464bc5304674b84ea42615a3fd0bd949\",\"lessThan\":\"152b4123f21e6aff31cea01158176ad96a999c76\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e5a35635464bc5304674b84ea42615a3fd0bd949\",\"lessThan\":\"0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/arm64/kvm/vgic/vgic-init.c\",\"arch/arm64/kvm/vgic/vgic-mmio-v3.c\",\"arch/arm64/kvm/vgic/vgic.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.96\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.36\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.7\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:01:54.595799Z\",\"id\":\"CVE-2024-40989\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.13\",\"versionEndExcluding\":\"6.1.96\",\"matchCriteriaId\":\"4DAC77B7-CD9E-495B-8980-9EA73DE7EBA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.36\",\"matchCriteriaId\":\"E1046C95-860A-45B0-B718-2B29F65BFF10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.7\",\"matchCriteriaId\":\"0A047AF2-94AC-4A3A-B32D-6AB930D8EF1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"331C2F14-12C7-45D5-893D-8C52EE38EA10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3173713D-909A-4DD3-9DD4-1E171EB057EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"79F18AFA-40F7-43F0-BA30-7BDB65F918B9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/152b4123f21e6aff31cea01158176ad96a999c76\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/48bb62859d47c5c4197a8c01128d0fa4f46ee58c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/68df4fc449fcc24347209e500ce26d5816705a77\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/152b4123f21e6aff31cea01158176ad96a999c76\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/48bb62859d47c5c4197a8c01128d0fa4f46ee58c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/68df4fc449fcc24347209e500ce26d5816705a77\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:42:19+00:00",
      "cve": "CVE-2024-40989",
      "id": "CVE-2024-40989",
      "initial_release_date": "2024-07-12T00:00:00+00:00",
      "product_status:fixed": "943",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "51",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: arm64: Disassociate vcpus from redistributor region on teardown",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-40989.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-05T00:55:50Z",
      "cve": "CVE-2024-40989",
      "id": "CVE-2024-40989",
      "initial_release_date": "2024-07-16T02:34:04Z",
      "product_status:known_affected": "295",
      "product_status:known_not_affected": "169",
      "product_status:recommended": "806",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-40989",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-40989.json",
      "version": "79"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/68df4fc449fcc24347209e500ce26d5816705a77\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/48bb62859d47c5c4197a8c01128d0fa4f46ee58c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/152b4123f21e6aff31cea01158176ad96a999c76\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T21:58:53.765Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-40989\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:01:54.595799Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:22.092Z\"}}], \"cna\": {\"title\": \"KVM: arm64: Disassociate vcpus from redistributor region on teardown\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e5a35635464bc5304674b84ea42615a3fd0bd949\", \"lessThan\": \"68df4fc449fcc24347209e500ce26d5816705a77\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e5a35635464bc5304674b84ea42615a3fd0bd949\", \"lessThan\": \"48bb62859d47c5c4197a8c01128d0fa4f46ee58c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e5a35635464bc5304674b84ea42615a3fd0bd949\", \"lessThan\": \"152b4123f21e6aff31cea01158176ad96a999c76\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e5a35635464bc5304674b84ea42615a3fd0bd949\", \"lessThan\": \"0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/arm64/kvm/vgic/vgic-init.c\", \"arch/arm64/kvm/vgic/vgic-mmio-v3.c\", \"arch/arm64/kvm/vgic/vgic.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.13\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.13\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.96\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.36\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/arm64/kvm/vgic/vgic-init.c\", \"arch/arm64/kvm/vgic/vgic-mmio-v3.c\", \"arch/arm64/kvm/vgic/vgic.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/68df4fc449fcc24347209e500ce26d5816705a77\"}, {\"url\": \"https://git.kernel.org/stable/c/48bb62859d47c5c4197a8c01128d0fa4f46ee58c\"}, {\"url\": \"https://git.kernel.org/stable/c/152b4123f21e6aff31cea01158176ad96a999c76\"}, {\"url\": \"https://git.kernel.org/stable/c/0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: arm64: Disassociate vcpus from redistributor region on teardown\\n\\nWhen tearing down a redistributor region, make sure we don\u0027t have\\nany dangling pointer to that region stored in a vcpu.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.96\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.36\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.7\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"5.13\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:23:43.682Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-40989\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:23:43.682Z\", \"dateReserved\": \"2024-07-12T12:17:45.605Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-12T12:37:33.823Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.