CVE-2026-74607: KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
Interaction between KVMCAPVMMOVEENCCONTEXTFROM and KVMCAPVMCOPYENCCONTEXTFROM can cause two separate issues:
- in sevmigratefrom(), when the destination KVM is a mirror, the mirror entry is moved from the source's list to the owner's mirrorvms list, without holding the owner's lock unlike other writers of the owner's mirror list (sevvmcopyenccontextfrom(), sevvmdestroy()). A concurrent COPY or destroy can race with sevmigratefrom() and corrupt the list.
- In sevvmdestroy(), the owner is still active and could receive concurrently a KVMCAPVMMOVEENCCONTEXTFROM that causes sev->enccontextowner to change. In this case the incorrect VM receives kvmputkvm().
The second issue needs particular care because the owner could disappear altogether (even though the race window is impossibly small) between reading it and locking it. There is thus no way to perform the checks under the owner lock without putting struct kvm under SLABTYPESAFEBYRCU (which would allow kvmgetkvmsafe() under RCU critical section).
It is much simpler to just use a global lock, since the critical sections are so small and the new lock is always a leaf lock.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1
Event History
Frequently Asked Questions
What concurrent operations are required to trigger the affected races?
The races involve KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM interacting with KVM_CAP_VM_COPY_ENC_CONTEXT_FROM. A concurrent encrypted-context copy or VM destruction can race with sev_migrate_from(), and a move operation can also race with sev_vm_destroy() while the owner remains active.
What can happen if the race occurs?
A concurrent operation can corrupt the owner's mirror-VM list. In the destruction race, kvm_put_kvm() can be applied to the wrong VM, and the owner VM could disappear during the race window.