{
  "cveId": "CVE-2024-50114",
  "url": "https://patchblox.com/security/cve/CVE-2024-50114",
  "summary": "CVE-2024-50114 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-50114, released November 5, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  KVM: arm64: Unregister redistributor for failed...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: arm64: Unregister redistributor for failed vCPU creation  Alex reports that syzkaller has managed to trigger a use-after-free when tearing down a VM:    BUG: KASAN: slab-use-after-free in kvm_put_kvm\u002B0x300/0xe68 virt/kvm/kvm_main.c:5769   Read of size 8 at addr ffffff801c6890d0 by task syz.3.2219/10758    CPU: 3 UID: 0 PID: 10758 Comm: syz.3.2219 Not tainted 6.11.0-rc6-dirty #64   Hardware name: linux,dummy-virt (DT)   Call trace:    dump_backtrace\u002B0x17c/0x1a8 arch/arm64/kernel/stacktrace.c:317    show_stack\u002B0x2c/0x3c arch/arm64/kernel/stacktrace.c:324    __dump_stack lib/dump_stack.c:93 [inline]    dump_stack_lvl\u002B0x94/0xc0 lib/dump_stack.c:119    print_report\u002B0x144/0x7a4 mm/kasan/report.c:377    kasan_report\u002B0xcc/0x128 mm/kasan/report.c:601    __asan_report_load8_noabort\u002B0x20/0x2c mm/kasan/report_generic.c:381    kvm_put_kvm\u002B0x300/0xe68 virt/kvm/kvm_main.c:5769    kvm_vm_release\u002B0x4c/0x60 virt/kvm/kvm_main.c:1409    __fput\u002B0x198/0x71c fs/file_table.c:422    ____fput\u002B0x20/0x30 fs/file_table.c:450    task_work_run\u002B0x1cc/0x23c kernel/task_work.c:228    do_notify_resume\u002B0x144/0x1a0 include/linux/resume_user_mode.h:50    el0_svc\u002B0x64/0x68 arch/arm64/kernel/entry-common.c:169    el0t_64_sync_handler\u002B0x90/0xfc arch/arm64/kernel/entry-common.c:730    el0t_64_sync\u002B0x190/0x194 arch/arm64/kernel/entry.S:598  Upon closer inspection, it appears that we do not properly tear down the MMIO registration for a vCPU that fails creation late in the game, e.g. a vCPU w/ the same ID already exists in the VM.  It is important to consider the context of commit that introduced this bug by moving the unregistration out of __kvm_vgic_vcpu_destroy(). That change correctly sought to avoid an srcu v. config_lock inversion by breaking up the vCPU teardown into two parts, one guarded by the config_lock.  Fix the use-after-free while avoiding lock inversion by adding a special-cased unregistration to __kvm_vgic_vcpu_destroy(). This is safe because failed vCPUs are torn down outside of the config_lock.",
  "published": "2024-11-05T18:15:14Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00226,
  "epssPercentile": 0.13419,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.11.6-1",
      "fix": "DEBIAN-CVE-2024-50114",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-50114",
      "released": "2024-11-05T18:15:14Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.11.6-1",
      "fix": "DEBIAN-CVE-2024-50114",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-50114",
      "released": "2024-11-05T18:15:14Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}