# CVE-2024-50114: linux: In the Linux kernel, the following vulnerability has been resolved:  KVM: arm64: Unregister redistributor for failed...

CVE-2024-50114 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-50114, released November 5, 2024. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2024-50114
- Priority: High
- CVSS: 7.8 (high)
- EPSS: 0.0023
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Nov 5, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  KVM: arm64: Unregister redistributor for failed vCPU creation  Alex reports that syzkaller has managed to trigger a use-after-free when tearing down a VM:    BUG: KASAN: slab-use-after-free in kvm_put_kvm+0x300/0xe68 virt/kvm/kvm_main.c:5769   Read of size 8 at addr ffffff801c6890d0 by task syz.3.2219/10758    CPU: 3 UID: 0 PID: 10758 Comm: syz.3.2219 Not tainted 6.11.0-rc6-dirty #64   Hardware name: linux,dummy-virt (DT)   Call trace:    dump_backtrace+0x17c/0x1a8 arch/arm64/kernel/stacktrace.c:317    show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:324    __dump_stack lib/dump_stack.c:93 [inline]    dump_stack_lvl+0x94/0xc0 lib/dump_stack.c:119    print_report+0x144/0x7a4 mm/kasan/report.c:377    kasan_report+0xcc/0x128 mm/kasan/report.c:601    __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381    kvm_put_kvm+0x300/0xe68 virt/kvm/kvm_main.c:5769    kvm_vm_release+0x4c/0x60 virt/kvm/kvm_main.c:1409    __fput+0x198/0x71c fs/file_table.c:422    ____fput+0x20/0x30 fs/file_table.c:450    task_work_run+0x1cc/0x23c kernel/task_work.c:228    do_notify_resume+0x144/0x1a0 include/linux/resume_user_mode.h:50    el0_svc+0x64/0x68 arch/arm64/kernel/entry-common.c:169    el0t_64_sync_handler+0x90/0xfc arch/arm64/kernel/entry-common.c:730    el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598  Upon closer inspection, it appears that we do not properly tear down the MMIO registration for a vCPU that fails creation late in the game, e.g. a vCPU w/ the same ID already exists in the VM.  It is important to consider the context of commit that introduced this bug by moving the unregistration out of __kvm_vgic_vcpu_destroy(). That change correctly sought to avoid an srcu v. config_lock inversion by breaking up the vCPU teardown into two parts, one guarded by the config_lock.  Fix the use-after-free while avoiding lock inversion by adding a special-cased unregistration to __kvm_vgic_vcpu_destroy(). This is safe because failed vCPUs are torn down outside of the config_lock.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.11.6-1 | [DEBIAN-CVE-2024-50114](https://patchblox.com/security/data/fix/linux/debian-cve-2024-50114.md) | Nov 5, 2024 |
| Linux | linux Debian 14 | 6.11.6-1 | [DEBIAN-CVE-2024-50114](https://patchblox.com/security/data/fix/linux/debian-cve-2024-50114.md) | Nov 5, 2024 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.