{ "cveId": "CVE-2024-47744", "url": "https://patchblox.com/security/cve/CVE-2024-47744", "summary": "CVE-2024-47744 is fixed in 26 products on 1 platform, first by DEBIAN-CVE-2024-47744, released October 21, 2024. It is not reported as exploited. Patch Radar priority: Routine.", "title": "linux: In the Linux kernel, the following vulnerability has been resolved: KVM: Use dedicated mutex to protect kvm_usage_co...", "description": "In the Linux kernel, the following vulnerability has been resolved: KVM: Use dedicated mutex to protect kvm_usage_count to avoid deadlock Use a dedicated mutex to guard kvm_usage_count to fix a potential deadlock on x86 due to a chain of locks and SRCU synchronizations. Translating the below lockdep splat, CPU1 #6 will wait on CPU0 #1, CPU0 #8 will wait on CPU2 #3, and CPU2 #7 will wait on CPU1 #4 (if there\u0027s a writer, due to the fairness of r/w semaphores). CPU0 CPU1 CPU2 1 lock(\u0026kvm-\u003Eslots_lock); 2 lock(\u0026vcpu-\u003Emutex); 3 lock(\u0026kvm-\u003Esrcu); 4 lock(cpu_hotplug_lock); 5 lock(kvm_lock); 6 lock(\u0026kvm-\u003Eslots_lock); 7 lock(cpu_hotplug_lock); 8 sync(\u0026kvm-\u003Esrcu); Note, there are likely more potential deadlocks in KVM x86, e.g. the same pattern of taking cpu_hotplug_lock outside of kvm_lock likely exists with __kvmclock_cpufreq_notifier(): cpuhp_cpufreq_online() | -\u003E cpufreq_online() | -\u003E cpufreq_gov_performance_limits() | -\u003E __cpufreq_driver_target() | -\u003E __target_index() | -\u003E cpufreq_freq_transition_begin() | -\u003E cpufreq_notify_transition() | -\u003E ... __kvmclock_cpufreq_notifier() But, actually triggering such deadlocks is beyond rare due to the combination of dependencies and timings involved. E.g. the cpufreq notifier is only used on older CPUs without a constant TSC, mucking with the NX hugepage mitigation while VMs are running is very uncommon, and doing so while also onlining/offlining a CPU (necessary to generate contention on cpu_hotplug_lock) would be even more unusual. The most robust solution to the general cpu_hotplug_lock issue is likely to switch vm_list to be an RCU-protected list, e.g. so that x86\u0027s cpufreq notifier doesn\u0027t to take kvm_lock. For now, settle for fixing the most blatant deadlock, as switching to an RCU-protected list is a much more involved change, but add a comment in locking.rst to call out that care needs to be taken when walking holding kvm_lock and walking vm_list. ====================================================== WARNING: possible circular locking dependency detected 6.10.0-smp--c257535a0c9d-pip #330 Tainted: G S O ------------------------------------------------------ tee/35048 is trying to acquire lock: ff6a80eced71e0a8 (\u0026kvm-\u003Eslots_lock){\u002B.\u002B.}-{3:3}, at: set_nx_huge_pages\u002B0x179/0x1e0 [kvm] but task is already holding lock: ffffffffc07abb08 (kvm_lock){\u002B.\u002B.}-{3:3}, at: set_nx_huge_pages\u002B0x14a/0x1e0 [kvm] which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -\u003E #3 (kvm_lock){\u002B.\u002B.}-{3:3}: __mutex_lock\u002B0x6a/0xb40 mutex_lock_nested\u002B0x1f/0x30 kvm_dev_ioctl\u002B0x4fb/0xe50 [kvm] __se_sys_ioctl\u002B0x7b/0xd0 __x64_sys_ioctl\u002B0x21/0x30 x64_sys_call\u002B0x15d0/0x2e60 do_syscall_64\u002B0x83/0x160 entry_SYSCALL_64_after_hwframe\u002B0x76/0x7e -\u003E #2 (cpu_hotplug_lock){\u002B\u002B\u002B\u002B}-{0:0}: cpus_read_lock\u002B0x2e/0xb0 static_key_slow_inc\u002B0x16/0x30 kvm_lapic_set_base\u002B0x6a/0x1c0 [kvm] kvm_set_apic_base\u002B0x8f/0xe0 [kvm] kvm_set_msr_common\u002B0x9ae/0xf80 [kvm] vmx_set_msr\u002B0xa54/0xbe0 [kvm_intel] __kvm_set_msr\u002B0xb6/0x1a0 [kvm] kvm_arch_vcpu_ioctl\u002B0xeca/0x10c0 [kvm] kvm_vcpu_ioctl\u002B0x485/0x5b0 [kvm] __se_sys_ioctl\u002B0x7b/0xd0 __x64_sys_ioctl\u002B0x21/0x30 x64_sys_call\u002B0x15d0/0x2e60 do_syscall_64\u002B0x83/0x160 entry_SYSCALL_64_after_hwframe\u002B0x76/0x7e -\u003E #1 (\u0026kvm-\u003Esrcu){.\u002B.\u002B}-{0:0}: __synchronize_srcu\u002B0x44/0x1a0 ---truncated---", "published": "2024-10-21T13:15:04Z", "severity": "medium", "cvss": 5.5, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epss": 0.00168, "epssPercentile": 0.06077, "priority": "Routine", "priorityTier": 4, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "dtb-aarch64", "release": "opensuse-leap 15.6", "fixedVersion": "6.4.0-150600.23.30.1", "fix": "SUSE-SU-2024:4318-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4318-1", "released": "2024-12-13T15:33:38Z" }, { "platform": "linux", "product": "kernel-64kb", "release": "opensuse-leap 15.6", "fixedVersion": "6.4.0-150600.23.30.1", "fix": "SUSE-SU-2024:4318-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4318-1", "released": "2024-12-13T15:33:38Z" }, { "platform": "linux", "product": "kernel-64kb", "release": "sles 15.6", "fixedVersion": "6.4.0-150600.23.30.1", "fix": "SUSE-SU-2024:4318-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4318-1", "released": "2024-12-13T15:33:38Z" }, { "platform": "linux", "product": "kernel-azure", "release": "opensuse-leap 15.6", "fixedVersion": "6.4.0-150600.8.17.2", "fix": "SUSE-SU-2024:3984-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-3984-1", "released": "2024-11-13T10:13:12Z" }, { "platform": "linux", "product": "kernel-azure", "release": "sles 15.6", "fixedVersion": "6.4.0-150600.8.17.2", "fix": "SUSE-SU-2024:3984-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-3984-1", "released": "2024-11-13T10:13:12Z" }, { "platform": "linux", "product": "kernel-coco", "release": "sles 15.6", "fixedVersion": "6.4.0-15061.9.coco15sp6.1", "fix": "SUSE-SU-2024:4387-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4387-1", "released": "2024-12-19T15:39:02Z" }, { "platform": "linux", "product": "kernel-coco_debug", "release": "sles 15.6", "fixedVersion": "6.4.0-15061.9.coco15sp6.1", "fix": "SUSE-SU-2024:4387-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4387-1", "released": "2024-12-19T15:39:02Z" }, { "platform": "linux", "product": "kernel-debug", "release": "opensuse-leap 15.6", "fixedVersion": "6.4.0-150600.23.30.1", "fix": "SUSE-SU-2024:4318-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4318-1", "released": "2024-12-13T15:33:38Z" }, { "platform": "linux", "product": "kernel-default", "release": "opensuse-leap 15.6", "fixedVersion": "6.4.0-150600.23.30.1", "fix": "SUSE-SU-2024:4318-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4318-1", "released": "2024-12-13T15:33:38Z" }, { "platform": "linux", "product": "kernel-default", "release": "sles 15.6", "fixedVersion": "6.4.0-150600.23.30.1", "fix": "SUSE-SU-2024:4318-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4318-1", "released": "2024-12-13T15:33:38Z" }, { "platform": "linux", "product": "kernel-default-base", "release": "opensuse-leap 15.6", "fixedVersion": "6.4.0-150600.23.30.1.150600.12.12.6", "fix": "SUSE-SU-2024:4318-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4318-1", "released": "2024-12-13T15:33:38Z" }, { "platform": "linux", "product": "kernel-default-base", "release": "sles 15.6", "fixedVersion": "6.4.0-150600.23.30.1.150600.12.12.6", "fix": "SUSE-SU-2024:4318-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4318-1", "released": "2024-12-13T15:33:38Z" }, { "platform": "linux", "product": "kernel-docs", "release": "opensuse-leap 15.6", "fixedVersion": "6.4.0-150600.23.30.1", "fix": "SUSE-SU-2024:4318-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4318-1", "released": "2024-12-13T15:33:38Z" }, { "platform": "linux", "product": "kernel-docs", "release": "sles 15.6", "fixedVersion": "6.4.0-150600.23.30.1", "fix": "SUSE-SU-2024:4318-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4318-1", "released": "2024-12-13T15:33:38Z" }, { "platform": "linux", "product": "kernel-kvmsmall", "release": "opensuse-leap 15.6", "fixedVersion": "6.4.0-150600.23.30.1", "fix": "SUSE-SU-2024:4318-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4318-1", "released": "2024-12-13T15:33:38Z" }, { "platform": "linux", "product": "kernel-livepatch-SLE15-SP6-RT_Update_5", "release": "sles 15.6", "fixedVersion": "1-150600.1.3.1", "fix": "SUSE-SU-2024:3986-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-3986-1", "released": "2024-11-13T10:13:55Z" }, { "platform": "linux", "product": "kernel-livepatch-SLE15-SP6_Update_6", "release": "sles 15.6", "fixedVersion": "1-150600.13.3.5", "fix": "SUSE-SU-2024:4318-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4318-1", "released": "2024-12-13T15:33:38Z" }, { "platform": "linux", "product": "kernel-obs-build", "release": "opensuse-leap 15.6", "fixedVersion": "6.4.0-150600.23.30.1", "fix": "SUSE-SU-2024:4318-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4318-1", "released": "2024-12-13T15:33:38Z" }, { "platform": "linux", "product": "kernel-obs-build", "release": "sles 15.6", "fixedVersion": "6.4.0-150600.23.30.1", "fix": "SUSE-SU-2024:4318-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4318-1", "released": "2024-12-13T15:33:38Z" }, { "platform": "linux", "product": "kernel-obs-qa", "release": "opensuse-leap 15.6", "fixedVersion": "6.4.0-150600.23.30.1", "fix": "SUSE-SU-2024:4318-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4318-1", "released": "2024-12-13T15:33:38Z" }, { "platform": "linux", "product": "kernel-rt", "release": "opensuse-leap 15.6", "fixedVersion": "6.4.0-150600.10.17.1", "fix": "SUSE-SU-2024:3986-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-3986-1", "released": "2024-11-13T10:13:55Z" }, { "platform": "linux", "product": "kernel-rt_debug", "release": "opensuse-leap 15.6", "fixedVersion": "6.4.0-150600.10.17.1", "fix": "SUSE-SU-2024:3986-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-3986-1", "released": "2024-11-13T10:13:55Z" }, { "platform": "linux", "product": "kernel-source", "release": "opensuse-leap 15.6", "fixedVersion": "6.4.0-150600.23.30.1", "fix": "SUSE-SU-2024:4318-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4318-1", "released": "2024-12-13T15:33:38Z" }, { "platform": "linux", "product": "kernel-source", "release": "sles 15.6", "fixedVersion": "6.4.0-150600.23.30.1", "fix": "SUSE-SU-2024:4318-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4318-1", "released": "2024-12-13T15:33:38Z" }, { "platform": "linux", "product": "kernel-source-azure", "release": "opensuse-leap 15.6", "fixedVersion": "6.4.0-150600.8.17.1", "fix": "SUSE-SU-2024:3984-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-3984-1", "released": "2024-11-13T10:13:12Z" }, { "platform": "linux", "product": "kernel-source-azure", "release": "sles 15.6", "fixedVersion": "6.4.0-150600.8.17.1", "fix": "SUSE-SU-2024:3984-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-3984-1", "released": "2024-11-13T10:13:12Z" }, { "platform": "linux", "product": "kernel-source-coco", "release": "sles 15.6", "fixedVersion": "6.4.0-15061.9.coco15sp6.1", "fix": "SUSE-SU-2024:4387-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4387-1", "released": "2024-12-19T15:39:02Z" }, { "platform": "linux", "product": "kernel-source-rt", "release": "opensuse-leap 15.6", "fixedVersion": "6.4.0-150600.10.17.1", "fix": "SUSE-SU-2024:3986-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-3986-1", "released": "2024-11-13T10:13:55Z" }, { "platform": "linux", "product": "kernel-syms", "release": "opensuse-leap 15.6", "fixedVersion": "6.4.0-150600.23.30.1", "fix": "SUSE-SU-2024:4318-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4318-1", "released": "2024-12-13T15:33:38Z" }, { "platform": "linux", "product": "kernel-syms", "release": "sles 15.6", "fixedVersion": "6.4.0-150600.23.30.1", "fix": "SUSE-SU-2024:4318-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4318-1", "released": "2024-12-13T15:33:38Z" }, { "platform": "linux", "product": "kernel-syms-azure", "release": "opensuse-leap 15.6", "fixedVersion": "6.4.0-150600.8.17.1", "fix": "SUSE-SU-2024:3984-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-3984-1", "released": "2024-11-13T10:13:12Z" }, { "platform": "linux", "product": "kernel-syms-azure", "release": "sles 15.6", "fixedVersion": "6.4.0-150600.8.17.1", "fix": "SUSE-SU-2024:3984-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-3984-1", "released": "2024-11-13T10:13:12Z" }, { "platform": "linux", "product": "kernel-syms-coco", "release": "sles 15.6", "fixedVersion": "6.4.0-15061.9.coco15sp6.1", "fix": "SUSE-SU-2024:4387-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4387-1", "released": "2024-12-19T15:39:02Z" }, { "platform": "linux", "product": "kernel-syms-rt", "release": "opensuse-leap 15.6", "fixedVersion": "6.4.0-150600.10.17.1", "fix": "SUSE-SU-2024:3986-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-3986-1", "released": "2024-11-13T10:13:55Z" }, { "platform": "linux", "product": "kernel-zfcpdump", "release": "opensuse-leap 15.6", "fixedVersion": "6.4.0-150600.23.30.1", "fix": "SUSE-SU-2024:4318-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4318-1", "released": "2024-12-13T15:33:38Z" }, { "platform": "linux", "product": "kernel-zfcpdump", "release": "sles 15.6", "fixedVersion": "6.4.0-150600.23.30.1", "fix": "SUSE-SU-2024:4318-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4318-1", "released": "2024-12-13T15:33:38Z" }, { "platform": "linux", "product": "linux", "release": "Debian 13.5 (trixie)", "fixedVersion": "6.11.2-1", "fix": "DEBIAN-CVE-2024-47744", "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-47744", "released": "2024-10-21T13:15:04Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "6.11.2-1", "fix": "DEBIAN-CVE-2024-47744", "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-47744", "released": "2024-10-21T13:15:04Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T00:53:09Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }