REDHAT-BUG-2365271: Use After Free
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Tear down vGIC on failed vCPU creation
If kvmarchvcpucreate() fails to share the vCPU page with the hypervisor, we propagate the error back to the ioctl but leave the vGIC vCPU data initialised. Note only does this leak the corresponding memory when the vCPU is destroyed but it can also lead to use-after-free if the redistributor device handling tries to walk into the vCPU.
Add the missing cleanup to kvmarchvcpucreate(), ensuring that the vGIC vCPU structures are destroyed on error.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2365271?
The severity of REDHAT-BUG-2365271 is considered high due to the potential impact on virtualized environments.
How do I fix REDHAT-BUG-2365271?
To fix REDHAT-BUG-2365271, apply the latest kernel update provided by Red Hat that addresses this vulnerability.
What systems are affected by REDHAT-BUG-2365271?
REDHAT-BUG-2365271 affects systems running vulnerable versions of the Linux kernel that utilize KVM for virtualization.
What is the impact of REDHAT-BUG-2365271?
The impact of REDHAT-BUG-2365271 can lead to improper handling of vCPU data, potentially compromising the stability of virtual machines.
When was REDHAT-BUG-2365271 disclosed?
REDHAT-BUG-2365271 was disclosed as part of a bug report in early 2025, highlighting issues with virtual CPU management in KVM.