CVE-2024-26598 (GCVE-0-2024-26598)

Vulnerability from cvelistv5 – Published: 2024-02-23 14:46 – Updated: 2026-08-05 11:26
VLAI
Title
KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command. The root of the problem is that vgic_its_check_cache() does not elevate the refcount on the vgic_irq before dropping the lock that serializes refcount changes. Have vgic_its_check_cache() raise the refcount on the returned vgic_irq and add the corresponding decrement after queueing the interrupt.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-22 16:15 UTC
CWE
Assigner
Linux CNA under the mitre root
CNA scorecard D 54/100 over 6619 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6211753fdfd05af9e08f54c8d0ba3ee516034878 , < d04acadb6490aa3314f9c9e087691e55de153b88 (git)
Affected: 6211753fdfd05af9e08f54c8d0ba3ee516034878 , < ba7be666740847d967822bed15500656b26bc703 (git)
Affected: 6211753fdfd05af9e08f54c8d0ba3ee516034878 , < 12c2759ab1343c124ed46ba48f27bd1ef5d2dff4 (git)
Affected: 6211753fdfd05af9e08f54c8d0ba3ee516034878 , < dba788e25f05209adf2b0175eb1691dc89fb1ba6 (git)
Affected: 6211753fdfd05af9e08f54c8d0ba3ee516034878 , < 65b201bf3e9af1b0254243a5881390eda56f72d1 (git)
Affected: 6211753fdfd05af9e08f54c8d0ba3ee516034878 , < dd3956a1b3dd11f46488c928cb890d6937d1ca80 (git)
Affected: 6211753fdfd05af9e08f54c8d0ba3ee516034878 , < ad362fe07fecf0aba839ff2cc59a3617bd42c33f (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.11
Unaffected: 0 , < 3.11 (semver)
Unaffected: 5.4.269 , ≤ 5.4.* (semver)
Unaffected: 5.10.209 , ≤ 5.10.* (semver)
Unaffected: 5.15.148 , ≤ 5.15.* (semver)
Unaffected: 6.1.75 , ≤ 6.1.* (semver)
Unaffected: 6.6.14 , ≤ 6.6.* (semver)
Unaffected: 6.7.2 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
linux linux_kernel Affected: 1da177e4c3f4 , < d04acadb6490 (custom)
Affected: 1da177e4c3f4 , < ba7be6667408 (custom)
Affected: 1da177e4c3f4 , < 12c2759ab134 (custom)
Affected: 1da177e4c3f4 , < dba788e25f05 (custom)
Affected: 1da177e4c3f4 , < 65b201bf3e9a (custom)
Affected: 1da177e4c3f4 , < dd3956a1b3dd (custom)
Affected: 1da177e4c3f4 , < ad362fe07fec (custom)
Unaffected: 5.4.269 , ≤ 5.5 (custom)
Unaffected: 5.10.209 , ≤ 5.11 (custom)
Unaffected: 5.15.148 , ≤ 5.16 (custom)
Unaffected: 6.1.75 , ≤ 6.2 (custom)
Unaffected: 6.6.14 , ≤ 6.7 (custom)
Unaffected: 6.7.2 , ≤ 6.8 (custom)
Unaffected: 6.8 , ≤ * (custom)
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:07:19.689Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d04acadb6490aa3314f9c9e087691e55de153b88"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ba7be666740847d967822bed15500656b26bc703"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/12c2759ab1343c124ed46ba48f27bd1ef5d2dff4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dba788e25f05209adf2b0175eb1691dc89fb1ba6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/65b201bf3e9af1b0254243a5881390eda56f72d1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dd3956a1b3dd11f46488c928cb890d6937d1ca80"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ad362fe07fecf0aba839ff2cc59a3617bd42c33f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "d04acadb6490",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              },
              {
                "lessThan": "ba7be6667408",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              },
              {
                "lessThan": "12c2759ab134",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              },
              {
                "lessThan": "dba788e25f05",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              },
              {
                "lessThan": "65b201bf3e9a",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              },
              {
                "lessThan": "dd3956a1b3dd",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              },
              {
                "lessThan": "ad362fe07fec",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "5.5",
                "status": "unaffected",
                "version": "5.4.269",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "5.11",
                "status": "unaffected",
                "version": "5.10.209",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "5.16",
                "status": "unaffected",
                "version": "5.15.148",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.2",
                "status": "unaffected",
                "version": "6.1.75",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.7",
                "status": "unaffected",
                "version": "6.6.14",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.8",
                "status": "unaffected",
                "version": "6.7.2",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "6.8",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-26598",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-22T16:15:47.782832Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-22T16:16:01.155Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/vgic/vgic-its.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d04acadb6490aa3314f9c9e087691e55de153b88",
              "status": "affected",
              "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
              "versionType": "git"
            },
            {
              "lessThan": "ba7be666740847d967822bed15500656b26bc703",
              "status": "affected",
              "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
              "versionType": "git"
            },
            {
              "lessThan": "12c2759ab1343c124ed46ba48f27bd1ef5d2dff4",
              "status": "affected",
              "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
              "versionType": "git"
            },
            {
              "lessThan": "dba788e25f05209adf2b0175eb1691dc89fb1ba6",
              "status": "affected",
              "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
              "versionType": "git"
            },
            {
              "lessThan": "65b201bf3e9af1b0254243a5881390eda56f72d1",
              "status": "affected",
              "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
              "versionType": "git"
            },
            {
              "lessThan": "dd3956a1b3dd11f46488c928cb890d6937d1ca80",
              "status": "affected",
              "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
              "versionType": "git"
            },
            {
              "lessThan": "ad362fe07fecf0aba839ff2cc59a3617bd42c33f",
              "status": "affected",
              "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/vgic/vgic-its.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.11"
            },
            {
              "lessThan": "3.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.269",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.269",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.209",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.148",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.75",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.14",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.2",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache\n\nThere is a potential UAF scenario in the case of an LPI translation\ncache hit racing with an operation that invalidates the cache, such\nas a DISCARD ITS command. The root of the problem is that\nvgic_its_check_cache() does not elevate the refcount on the vgic_irq\nbefore dropping the lock that serializes refcount changes.\n\nHave vgic_its_check_cache() raise the refcount on the returned vgic_irq\nand add the corresponding decrement after queueing the interrupt."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires running code inside a KVM/arm64 guest (to issue ITS DISCARD/MAPD commands via GITS_CWRITER) or holding local /dev/kvm access to drive KVM_SIGNAL_MSI, so the attacker needs local access to the host or a VM on it. No purely remote network path can drive both sides of the race.\nAC:L - The attacker controls both sides of the race \u2014 one vCPU thread issues DISCARD/MAPD ITS commands while another CPU (vhost worker via irqfd, or a userspace KVM_SIGNAL_MSI thread) performs the cache lookup \u2014 and can prime the cache deterministically with an INT command and repeat the loop indefinitely without any detection or rate limit.\nPR:L - The attacker only needs to be an unprivileged guest (or a local unprivileged user with /dev/kvm access, which is standard on virtualization hosts); no host root or special capability is required, and ITS emulation is created by default by QEMU\u0027s virt machine with GICv3.\nUI:N - The entire sequence \u2014 MAPTI/INT to populate the translation cache, MSI generation, and the DISCARD command \u2014 is driven autonomously by the attacker from inside the guest. No victim action is needed.\nS:C - The vulnerable component is KVM\u0027s vGIC ITS emulation, whose security authority is the guest VM, but the corrupted memory is host kernel heap; a guest crossing into host kernel memory is a guest-to-host boundary violation.\nC:H - The freed vgic_irq can be reallocated with attacker-controlled data and is then read back (intid, priority, group, config, vcpu/target_vcpu pointers) and re-linked into live host kernel lists, giving an arbitrary-pointer dereference and kernel memory disclosure primitive.\nI:H - The stale pointer is written through \u2014 spinlock acquire, pending_latch store, kref increment, and list_add_tail writing both into the freed chunk and storing its address into the live ap_list \u2014 a use-after-free write primitive leveragable for control-flow hijack and host privilege escalation.\nA:H - Even without successful heap grooming, the use-after-free corrupts the vgic ap_list and LPI list, reliably producing kernel oops, list-corruption BUG, or lock-up, taking down the entire host and all co-resident VMs."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:26:10.792Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d04acadb6490aa3314f9c9e087691e55de153b88"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba7be666740847d967822bed15500656b26bc703"
        },
        {
          "url": "https://git.kernel.org/stable/c/12c2759ab1343c124ed46ba48f27bd1ef5d2dff4"
        },
        {
          "url": "https://git.kernel.org/stable/c/dba788e25f05209adf2b0175eb1691dc89fb1ba6"
        },
        {
          "url": "https://git.kernel.org/stable/c/65b201bf3e9af1b0254243a5881390eda56f72d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd3956a1b3dd11f46488c928cb890d6937d1ca80"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad362fe07fecf0aba839ff2cc59a3617bd42c33f"
        }
      ],
      "title": "KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26598",
    "datePublished": "2024-02-23T14:46:26.672Z",
    "dateReserved": "2024-02-19T14:20:24.128Z",
    "dateUpdated": "2026-08-05T11:26:10.792Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26598",
      "date": "2026-10-13",
      "epss": "0.0024",
      "percentile": "0.13948"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/arm64/kvm/vgic/vgic-its.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d04acadb6490aa3314f9c9e087691e55de153b88",
                    "status": "affected",
                    "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ba7be666740847d967822bed15500656b26bc703",
                    "status": "affected",
                    "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "12c2759ab1343c124ed46ba48f27bd1ef5d2dff4",
                    "status": "affected",
                    "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dba788e25f05209adf2b0175eb1691dc89fb1ba6",
                    "status": "affected",
                    "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "65b201bf3e9af1b0254243a5881390eda56f72d1",
                    "status": "affected",
                    "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dd3956a1b3dd11f46488c928cb890d6937d1ca80",
                    "status": "affected",
                    "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ad362fe07fecf0aba839ff2cc59a3617bd42c33f",
                    "status": "affected",
                    "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/arm64/kvm/vgic/vgic-its.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.11"
                  },
                  {
                    "lessThan": "3.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.269",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.209",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.75",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.14",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.7.*",
                    "status": "unaffected",
                    "version": "6.7.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.8",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "linux_kernel",
                "vendor": "linux",
                "versions": [
                  {
                    "lessThan": "d04acadb6490",
                    "status": "affected",
                    "version": "1da177e4c3f4",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "ba7be6667408",
                    "status": "affected",
                    "version": "1da177e4c3f4",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "12c2759ab134",
                    "status": "affected",
                    "version": "1da177e4c3f4",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "dba788e25f05",
                    "status": "affected",
                    "version": "1da177e4c3f4",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "65b201bf3e9a",
                    "status": "affected",
                    "version": "1da177e4c3f4",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "dd3956a1b3dd",
                    "status": "affected",
                    "version": "1da177e4c3f4",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "ad362fe07fec",
                    "status": "affected",
                    "version": "1da177e4c3f4",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "5.5",
                    "status": "unaffected",
                    "version": "5.4.269",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "5.11",
                    "status": "unaffected",
                    "version": "5.10.209",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "5.16",
                    "status": "unaffected",
                    "version": "5.15.148",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "6.2",
                    "status": "unaffected",
                    "version": "6.1.75",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "6.7",
                    "status": "unaffected",
                    "version": "6.6.14",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "6.8",
                    "status": "unaffected",
                    "version": "6.7.2",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.8",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E2B90340-A8CC-4956-9F40-F37195011EC7",
                    "versionEndExcluding": "5.4.269",
                    "versionStartIncluding": "5.4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "74979A03-4B10-4815-AE3E-C8C0D2FDAA39",
                    "versionEndExcluding": "5.10.209",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2ED0CDB9-61B0-408E-B2A8-5199107F7868",
                    "versionEndExcluding": "5.15.148",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "070D0ED3-90D0-4F95-B1FF-57D7F46F332D",
                    "versionEndExcluding": "6.1.75",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5C6B50A6-3D8B-4CE2-BDCC-A098609CBA14",
                    "versionEndExcluding": "6.6.14",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7229C448-E0C9-488B-8939-36BA5254065E",
                    "versionEndExcluding": "6.7.2",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache\n\nThere is a potential UAF scenario in the case of an LPI translation\ncache hit racing with an operation that invalidates the cache, such\nas a DISCARD ITS command. The root of the problem is that\nvgic_its_check_cache() does not elevate the refcount on the vgic_irq\nbefore dropping the lock that serializes refcount changes.\n\nHave vgic_its_check_cache() raise the refcount on the returned vgic_irq\nand add the corresponding decrement after queueing the interrupt."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: arm64: vgic-its: Evite posibles UAF en la cach\u00e9 de traducci\u00f3n LPI. Existe un escenario potencial de UAF en el caso de que un cach\u00e9 de traducci\u00f3n LPI se acelere con una operaci\u00f3n que invalide la cach\u00e9, como un comando DISCARD ITS. La ra\u00edz del problema es que vgic_its_check_cache() no eleva el refcount en vgic_irq antes de eliminar el bloqueo que serializa los cambios de refcount. Haga que vgic_its_check_cache() aumente el refcount en el vgic_irq devuelto y agregue el decremento correspondiente despu\u00e9s de poner en cola la interrupci\u00f3n."
          }
        ],
        "id": "CVE-2024-26598",
        "lastModified": "2026-08-04T11:16:47.013",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-26598",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-22T16:15:47.782832Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-02-23T15:15:09.610",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/12c2759ab1343c124ed46ba48f27bd1ef5d2dff4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/65b201bf3e9af1b0254243a5881390eda56f72d1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ad362fe07fecf0aba839ff2cc59a3617bd42c33f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ba7be666740847d967822bed15500656b26bc703"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d04acadb6490aa3314f9c9e087691e55de153b88"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/dba788e25f05209adf2b0175eb1691dc89fb1ba6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/dd3956a1b3dd11f46488c928cb890d6937d1ca80"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/12c2759ab1343c124ed46ba48f27bd1ef5d2dff4"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/65b201bf3e9af1b0254243a5881390eda56f72d1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ad362fe07fecf0aba839ff2cc59a3617bd42c33f"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ba7be666740847d967822bed15500656b26bc703"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d04acadb6490aa3314f9c9e087691e55de153b88"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/dba788e25f05209adf2b0175eb1691dc89fb1ba6"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/dd3956a1b3dd11f46488c928cb890d6937d1ca80"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:13:00+00:00",
      "cve": "CVE-2024-26598",
      "id": "CVE-2024-26598",
      "initial_release_date": "2024-02-23T00:00:00+00:00",
      "product_status:fixed": "634",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "43",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: kvm: Avoid potential UAF in LPI translation cache",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26598.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T00:07:19.689Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/d04acadb6490aa3314f9c9e087691e55de153b88"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/ba7be666740847d967822bed15500656b26bc703"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/12c2759ab1343c124ed46ba48f27bd1ef5d2dff4"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/dba788e25f05209adf2b0175eb1691dc89fb1ba6"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/65b201bf3e9af1b0254243a5881390eda56f72d1"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/dd3956a1b3dd11f46488c928cb890d6937d1ca80"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/ad362fe07fecf0aba839ff2cc59a3617bd42c33f"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "linux_kernel",
                "vendor": "linux",
                "versions": [
                  {
                    "lessThan": "d04acadb6490",
                    "status": "affected",
                    "version": "1da177e4c3f4",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "ba7be6667408",
                    "status": "affected",
                    "version": "1da177e4c3f4",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "12c2759ab134",
                    "status": "affected",
                    "version": "1da177e4c3f4",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "dba788e25f05",
                    "status": "affected",
                    "version": "1da177e4c3f4",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "65b201bf3e9a",
                    "status": "affected",
                    "version": "1da177e4c3f4",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "dd3956a1b3dd",
                    "status": "affected",
                    "version": "1da177e4c3f4",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "ad362fe07fec",
                    "status": "affected",
                    "version": "1da177e4c3f4",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "5.5",
                    "status": "unaffected",
                    "version": "5.4.269",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "5.11",
                    "status": "unaffected",
                    "version": "5.10.209",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "5.16",
                    "status": "unaffected",
                    "version": "5.15.148",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "6.2",
                    "status": "unaffected",
                    "version": "6.1.75",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "6.7",
                    "status": "unaffected",
                    "version": "6.6.14",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "6.8",
                    "status": "unaffected",
                    "version": "6.7.2",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.8",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7.8,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-26598",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-04-22T16:15:47.782832Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-416",
                    "description": "CWE-416 Use After Free",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-08-07T15:34:11.687Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "arch/arm64/kvm/vgic/vgic-its.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "d04acadb6490aa3314f9c9e087691e55de153b88",
                  "status": "affected",
                  "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
                  "versionType": "git"
                },
                {
                  "lessThan": "ba7be666740847d967822bed15500656b26bc703",
                  "status": "affected",
                  "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
                  "versionType": "git"
                },
                {
                  "lessThan": "12c2759ab1343c124ed46ba48f27bd1ef5d2dff4",
                  "status": "affected",
                  "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
                  "versionType": "git"
                },
                {
                  "lessThan": "dba788e25f05209adf2b0175eb1691dc89fb1ba6",
                  "status": "affected",
                  "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
                  "versionType": "git"
                },
                {
                  "lessThan": "65b201bf3e9af1b0254243a5881390eda56f72d1",
                  "status": "affected",
                  "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
                  "versionType": "git"
                },
                {
                  "lessThan": "dd3956a1b3dd11f46488c928cb890d6937d1ca80",
                  "status": "affected",
                  "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
                  "versionType": "git"
                },
                {
                  "lessThan": "ad362fe07fecf0aba839ff2cc59a3617bd42c33f",
                  "status": "affected",
                  "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "arch/arm64/kvm/vgic/vgic-its.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "3.11"
                },
                {
                  "lessThan": "3.11",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.269",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.209",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.148",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.75",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.14",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.7.*",
                  "status": "unaffected",
                  "version": "6.7.2",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.8",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.269",
                      "versionStartIncluding": "3.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.209",
                      "versionStartIncluding": "3.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.148",
                      "versionStartIncluding": "3.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.75",
                      "versionStartIncluding": "3.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.14",
                      "versionStartIncluding": "3.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.7.2",
                      "versionStartIncluding": "3.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8",
                      "versionStartIncluding": "3.11",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache\n\nThere is a potential UAF scenario in the case of an LPI translation\ncache hit racing with an operation that invalidates the cache, such\nas a DISCARD ITS command. The root of the problem is that\nvgic_its_check_cache() does not elevate the refcount on the vgic_irq\nbefore dropping the lock that serializes refcount changes.\n\nHave vgic_its_check_cache() raise the refcount on the returned vgic_irq\nand add the corresponding decrement after queueing the interrupt."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - Exploitation requires running code inside a KVM/arm64 guest (to issue ITS DISCARD/MAPD commands via GITS_CWRITER) or holding local /dev/kvm access to drive KVM_SIGNAL_MSI, so the attacker needs local access to the host or a VM on it. No purely remote network path can drive both sides of the race.\nAC:L - The attacker controls both sides of the race \u2014 one vCPU thread issues DISCARD/MAPD ITS commands while another CPU (vhost worker via irqfd, or a userspace KVM_SIGNAL_MSI thread) performs the cache lookup \u2014 and can prime the cache deterministically with an INT command and repeat the loop indefinitely without any detection or rate limit.\nPR:L - The attacker only needs to be an unprivileged guest (or a local unprivileged user with /dev/kvm access, which is standard on virtualization hosts); no host root or special capability is required, and ITS emulation is created by default by QEMU\u0027s virt machine with GICv3.\nUI:N - The entire sequence \u2014 MAPTI/INT to populate the translation cache, MSI generation, and the DISCARD command \u2014 is driven autonomously by the attacker from inside the guest. No victim action is needed.\nS:C - The vulnerable component is KVM\u0027s vGIC ITS emulation, whose security authority is the guest VM, but the corrupted memory is host kernel heap; a guest crossing into host kernel memory is a guest-to-host boundary violation.\nC:H - The freed vgic_irq can be reallocated with attacker-controlled data and is then read back (intid, priority, group, config, vcpu/target_vcpu pointers) and re-linked into live host kernel lists, giving an arbitrary-pointer dereference and kernel memory disclosure primitive.\nI:H - The stale pointer is written through \u2014 spinlock acquire, pending_latch store, kref increment, and list_add_tail writing both into the freed chunk and storing its address into the live ap_list \u2014 a use-after-free write primitive leveragable for control-flow hijack and host privilege escalation.\nA:H - Even without successful heap grooming, the use-after-free corrupts the vgic ap_list and LPI list, reliably producing kernel oops, list-corruption BUG, or lock-up, taking down the entire host and all co-resident VMs."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:26:10.792Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/d04acadb6490aa3314f9c9e087691e55de153b88"
            },
            {
              "url": "https://git.kernel.org/stable/c/ba7be666740847d967822bed15500656b26bc703"
            },
            {
              "url": "https://git.kernel.org/stable/c/12c2759ab1343c124ed46ba48f27bd1ef5d2dff4"
            },
            {
              "url": "https://git.kernel.org/stable/c/dba788e25f05209adf2b0175eb1691dc89fb1ba6"
            },
            {
              "url": "https://git.kernel.org/stable/c/65b201bf3e9af1b0254243a5881390eda56f72d1"
            },
            {
              "url": "https://git.kernel.org/stable/c/dd3956a1b3dd11f46488c928cb890d6937d1ca80"
            },
            {
              "url": "https://git.kernel.org/stable/c/ad362fe07fecf0aba839ff2cc59a3617bd42c33f"
            }
          ],
          "title": "KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-26598",
        "datePublished": "2024-02-23T14:46:26.672Z",
        "dateReserved": "2024-02-19T14:20:24.128Z",
        "dateUpdated": "2026-08-05T11:26:10.792Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.