CVE-2024-50114

A use-after-free vulnerability was found in the Linux kernel. Proper tear down of the MMIO registration for a vCPU that fails creation late in the game, for example a vCPU w/ the same ID already existing in the VM, can lead to a deadlock condition.

A moderate-severity use-after-free vulnerability was found in the KVM (Kernel-based Virtual Machine) support for arm64 in the Linux kernel. When a vCPU fails to be created late in the creation process, for example when a vCPU with the same ID already exists in the VM, the VGIC redistributor MMIO registration for that vCPU is not properly torn down, leaving a stale registration that is accessed after it has been freed during VM destruction. A local user on an arm64 KVM host with the privileges needed to create and destroy virtual machines could use this flaw to trigger a kernel use-after-free, resulting in a denial of service (kernel crash). Red Hat has rated this flaw as moderate severity (CVSS 5.5) because successful exploitation can only result in a denial of service; this differs from the upstream NIST/CVE.org score of 7.8 (important), which reflects a broader confidentiality and integrity impact. The vulnerable code was introduced upstream in Linux kernel 6.11, which is not present in Red Hat Enterprise Linux 6, 7, or 8, so those releases are not affected. Red Hat Enterprise Linux 9 is affected, and a fix is being pursued through the delegated process. The Fedora kernel is affected, with the fix managed by the Fedora community. Hosted OpenShift cluster environments (ARO and OSD) are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.