CVE-2021-47062
kernel: KVM: SVM: null pointer in online_vcpus, not created_vcpus, to iterate over vCPUs
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · February 29, 2024
Updated · November 21, 2025
Description
A flaw was found in the Linux kernel's Kernel-based virtual machine (KVM) subsystem for AMD's Secure virtual machine (SVM). The issue occurs when using the created_vcpus list to iterate over vCPUs instead of the online_vcpus list, leading to a possible NULL pointer dereference. This vulnerability impacts the encryption of Virtual Machine Save Areas (VMSAs) for Secure Encrypted Virtualization (SEV).
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 4.4CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-476 · NULL Pointer Dereference