Description
In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
Interaction between KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM and
KVM_CAP_VM_COPY_ENC_CONTEXT_FROM can cause two separate issues:
- in sev_migrate_from(), when the destination KVM is a mirror, the mirror
entry is moved from the source's list to the owner's mirror_vms list,
without holding the owner's lock unlike other writers of the owner's
mirror list (sev_vm_copy_enc_context_from(), sev_vm_destroy()).
A concurrent COPY or destroy can race with sev_migrate_from() and
corrupt the list.
- In sev_vm_destroy(), the *owner* is still active and could receive
concurrently a KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM that causes
sev->enc_context_owner to change. In this case the incorrect VM
receives kvm_put_kvm().
The second issue needs particular care because the owner could disappear
altogether (even though the race window is impossibly small) between
reading it and locking it. There is thus no way to perform the checks
under the owner lock without putting struct kvm under SLAB_TYPESAFE_BY_RCU
(which would allow kvm_get_kvm_safe() under RCU critical section).
It is much simpler to just use a global lock, since the critical
sections are so small and the new lock is always a leaf lock.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 5.18 | 6.1.184 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 7.1.9-1 | — |
| Debian 13 | linux | 6.12.105-1 | — |
| Debian 12 | linux | 6.1.187-1 | — |
| Debian 12 | linux-6.12 | 6.12.107-1~deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 24.04 LTS | linux-bluefield | 6.8.0-1036.41 | — |
| Ubuntu 26.04 LTS | linux | 7.0.0-42.42 | USN-8959-1 |
| Ubuntu 26.04 LTS | linux-aws | 7.0.0-1016.17 | USN-8959-1 |
| Ubuntu 26.04 LTS | linux-azure | 7.0.0-1020.21 | USN-9019-1 |
| Ubuntu 26.04 LTS | linux-azure-fde | 7.0.0-1019.19 | USN-9020-1 |
| Ubuntu 26.04 LTS | linux-gcp | 7.0.0-1016.18 | USN-8959-1 |
| Ubuntu 26.04 LTS | linux-gke | 7.0.0-1010.11 | USN-9020-1 |
| Ubuntu 26.04 LTS | linux-ibm +1 | 7.0.0-1017.17 | USN-8960-1, USN-8959-1 |
| Ubuntu 26.04 LTS | linux-nvidia +1 | No fix yet | — |
| Ubuntu 26.04 LTS | linux-oracle | 7.0.0-1015.16 | USN-8959-1 |
| Ubuntu 26.04 LTS | linux-raspi | 7.0.0-1023.23 | USN-9021-1 |
| Ubuntu 26.04 LTS | linux-realtime | 7.0.0-43.43.1 | USN-9020-1 |
| Ubuntu 26.04 LTS | linux-riscv | 7.0.0-42.42.1 | — |
| Ubuntu 24.04 LTS | linux | 6.8.0-149.149 | USN-9022-1 |
| Ubuntu 24.04 LTS | linux-aws | 6.8.0-1069.74 | USN-9022-1 |
| Ubuntu 24.04 LTS | linux-aws-7.0 | 7.0.0-1017.18~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-azure | 6.8.0-1073.82 | USN-9022-1 |
| Ubuntu 24.04 LTS | linux-azure-fde | 6.8.0-1071.78 | USN-9039-1 |
| Ubuntu 24.04 LTS | linux-azure-fde-7.0 | 7.0.0-1019.19~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-gcp | 6.8.0-1073.81 | USN-9022-1 |
| Ubuntu 24.04 LTS | linux-gcp-7.0 | 7.0.0-1017.19~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-gke | 6.8.0-1068.77 | USN-9022-1 |
| Ubuntu 24.04 LTS | linux-gkeop | 6.8.0-1053.57 | USN-9023-1 |
| Ubuntu 24.04 LTS | linux-hwe-7.0 | 7.0.0-42.42~24.04.1 | USN-8959-1 |
| Ubuntu 24.04 LTS | linux-ibm | 6.8.0-1069.70 | USN-9022-1 |
| Ubuntu 24.04 LTS | linux-lowlatency | 6.8.0-149.149.1 | USN-9022-1 |
| Ubuntu 24.04 LTS | linux-nvidia | 6.8.0-1067.70 | USN-9024-1 |
| Ubuntu 24.04 LTS | linux-nvidia-lowlatency | 6.8.0-1067.70.1 | USN-9040-1 |
| Ubuntu 24.04 LTS | linux-nvidia-tegra | 6.8.0-1036.39 | USN-8886-1 |
| Ubuntu 24.04 LTS | linux-oracle | 6.8.0-1067.71 | USN-9022-1 |
| Ubuntu 24.04 LTS | linux-oracle-7.0 | 7.0.0-1016.18~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-raspi | 6.8.0-1068.72 | USN-9025-1 |
| Ubuntu 24.04 LTS | linux-riscv +31 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-riscv-7.0 | 7.0.0-42.42.1~24.04.1 | — |
| Ubuntu 24.04 LTS | linux-vmware | 6.8.0-1010.10 | USN-9022-1 |
| Ubuntu 22.04 LTS | linux-aws-6.8 | 6.8.0-1069.74~22.04.1 | USN-9024-1 |
| Ubuntu 22.04 LTS | linux-azure-6.8 | 6.8.0-1073.82~22.04.1 | USN-9026-1 |
| Ubuntu 22.04 LTS | linux-azure-fde-6.8 | 6.8.0-1071.78~22.04.1 | USN-9026-1 |
| Ubuntu 22.04 LTS | linux-gcp-6.8 | 6.8.0-1073.81~22.04.1 | USN-9024-1 |
| Ubuntu 22.04 LTS | linux-hwe-6.8 | 6.8.0-149.149~22.04.1 | USN-9066-1 |
| Ubuntu 22.04 LTS | linux-ibm-6.8 | 6.8.0-1069.70~22.04.1 | USN-9024-1 |
| Ubuntu 22.04 LTS | linux-lowlatency-hwe-6.8 | 6.8.0-149.149.1~22.04.1 | USN-9024-1 |
| Ubuntu 22.04 LTS | linux-oracle-6.8 | 6.8.0-1067.71~22.04.1 | USN-9025-1 |
| Ubuntu 22.04 LTS | linux-riscv +33 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-raspi-realtime | 6.8.0-2056.58 | USN-9025-1 |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime | 6.8.1-1064.65 | USN-9023-1 |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.14 +1 | No fix yet | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime-6.8 | 6.8.1-1064.65~22.04.1 | USN-9024-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-aws-fips | 6.8.0-1069.74+fips1 | USN-9023-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-azure-fips | 6.8.0-1073.82+fips1 | USN-9022-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-gcp-fips | 6.8.0-1073.81+fips1 | USN-9023-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | kernel-64kb +8 | 6.12.0-160000.41.1 | SUSE-SU-2026:24662-1 |
| SLES for SAP 16.0 | kernel-default-base | 6.12.0-160000.41.1.160000.2.32 | SUSE-SU-2026:24662-1 |
| SLES 16.0 | kernel-64kb +8 | 6.12.0-160000.41.1 | SUSE-SU-2026:24662-1, SUSE-SU-2026:24651-1 |
| SLES 16.0 | kernel-default-base | 6.12.0-160000.41.1.160000.2.32 | SUSE-SU-2026:24662-1 |
| SLE Micro 6.2 | kernel-default-base | 6.12.0-160000.41.1.160000.2.32 | SUSE-SU-2026:24643-1 |
| SLE Micro 6.2 | kernel-rt +5 | 6.12.0-160000.41.1 | SUSE-SU-2026:24648-1, SUSE-SU-2026:24643-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kernel | 6.6.157.1-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | kernel-uek +34 | 6.12.0-206.104.3.3.el10uek | ELSA-2026-500374, ELSA-2026-500248 |
Advisories 21
- USN-9066-1 linux-hwe-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-9021-1 linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-9022-1 linux, linux-aws, linux-azure, linux-azure-fips, linux-gcp, linux-gke, linux-ibm, linux-lowlatency, linux-oracle, linux-vmware vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-9024-1 linux-aws-6.8, linux-gcp-6.8, linux-ibm-6.8, linux-lowlatency-hwe-6.8, linux-nvidia, linux-realtime-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-9026-1 linux-azure-6.8, linux-azure-fde-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-9039-1 linux-azure-fde vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- WID-SEC-2026-2970 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- USN-9040-1 linux-nvidia-lowlatency vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-9020-1 linux-aws-7.0, linux-azure-fde, linux-azure-fde-7.0, linux-gcp-7.0, linux-gke, linux-oracle-7.0, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8959-1 linux, linux-aws, linux-gcp, linux-hwe-7.0, linux-ibm, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-9025-1 linux-oracle-6.8, linux-raspi, linux-raspi-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-9023-1 linux-aws-fips, linux-gcp-fips, linux-gkeop, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- SUSE-SU-2026:24662-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Nov 12, 2026
- SUSE-SU-2026:24651-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Nov 12, 2026
- SUSE-SU-2026:24643-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Nov 12, 2026
- SUSE-SU-2026:24648-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Nov 12, 2026
- USN-9019-1 linux-azure vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8960-1 linux-oem-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8886-1 linux-nvidia-tegra vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- ELSA-2026-500374 Important: Unbreakable Enterprise kernel security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 7, 2026
- ELSA-2026-500248 Important: Unbreakable Enterprise kernel security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Sep 4, 2026
References
- https://git.kernel.org/stable/c/7943ec3a6d0e7e0a2eb4943300bce089ac3e8c3e
- https://git.kernel.org/stable/c/28afde1edbd8b20058cbf4d75fb57876471ec334
- https://git.kernel.org/stable/c/328ab4fabe05af004d886659f8744076e320ddce
- https://git.kernel.org/stable/c/47976eaaf0a4eb46dade48b3246779090db9e3ec
- https://git.kernel.org/stable/c/d728baba0f20e49439fc7831bf3e4e7dee82161a
- https://git.kernel.org/stable/c/1d78d33275ef2a16c6d080910b291d0a97a0e613