CVE-2020-8834
Kernel: ppc: kvm: conflicting use of HSTATE_HOST_R1 to store r1 state leads to host stack corruption
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · April 7, 2020
Updated · June 28, 2026
Description
A flaw was found in the way the KVM hypervisor on the Power8 processor stores the r1 register state in the 'HSTATE_HOST_R1' field on the Linux kernel stack. This flaw occurs while handling hypercalls in Transactional Memory (TM) suspend mode in the kvmppc_save_tm and kvmppc_restore_tm routines, leading to host stack corruption. R1 register holds a stack frame address and its corruption leads the kernel into panic state. A guest user can use this flaw to crash the host kernel, resulting in a denial of service.
Statement
This issue does not affect the versions of the Linux kernel as shipped with the Red Hat Enterprise Linux 5, 6, 8 and Red Hat Enterprise MRG 2. This issue affects the versions of the kernel package as shipped with the Red Hat Enterprise Linux 7. Future kernel updates for the Red Hat Enterprise Linux 7 may address this issue.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 6CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
CWE-121 · Stack-based Buffer Overflow