CVE-2024-26976

A flaw was found in the KVM (Kernel-based Virtual Machine) subsystem in the Linux kernel. When virtual processors or virtual machines are destroyed, pending asynchronous page fault background tasks are not properly completed before resources are released. A local user with permissions to manage virtual machines could trigger this condition to cause a system hang or crash, resulting in a denial of service (DoS).

A moderate severity denial-of-service flaw was found in the KVM (Kernel-based Virtual Machine) subsystem of the Linux kernel. When a virtual CPU or an entire virtual machine is destroyed, pending asynchronous page fault background work is not properly completed before the related resources are released. A local user with permissions to manage virtual machines could trigger this condition to cause a system hang or crash, resulting in a denial of service. This flaw affects the kernel packages in Red Hat Enterprise Linux 8 and 9 (including kernel-rt), Red Hat's hosted OpenShift cluster offerings that ship those kernels, and Fedora, with fixes being pursued through the delegated kernel maintenance process; the Red Hat Enterprise Linux 6 and 7 Extended Life-cycle Support streams are out of support scope. Red Hat rates this flaw as MODERATE (CVSS 3.1 score 5.5, availability impact only), lower than the upstream HIGH rating (CVSS 3.1 score 7.8, which includes confidentiality and integrity impacts), because the available evidence establishes only a denial of service and no confidentiality or integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.