LiveActive security incident?Get immediate response
CVE Record

CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()

In the Linux kernel, the following vulnerability has been resolved: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() Use {READ,WRITE}_ONCE() to access kvm->last_boosted_vcpu to ensure the loads and stores are atomic. In the extremely unlikely scenario the compiler tears the stores, it's theoretically possible for KVM to attempt to get a vCPU using an out-of-bounds index, e.g. if the write is split into multiple 8-bit stores, and is paired with a 32-bit load on a VM with 257 vCPUs: CPU0 CPU1 last_boosted_vcpu = 0xff; (last_boosted_vcpu = 0x100) last_boosted_vcpu[15:8] = 0x01; i = (last_boosted_vcpu = 0x1ff) last_boosted_vcpu[7:0] = 0x00; vcpu = kvm->vcpu_array[0x1ff]; As detected by KCSAN: BUG: KCSAN: data-race in kvm_vcpu_on_spin [kvm] / kvm_vcpu_on_spin [kvm] write to 0xffffc90025a92344 of 4 bytes by task 4340 on cpu 16: kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4112) kvm handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:? arch/x86/kvm/vmx/vmx.c:6606) kvm_intel vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890) __x64_sys_ioctl (fs/ioctl.c:890) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) read to 0xffffc90025a92344 of 4 bytes by task 4342 on cpu 4: kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4069) kvm handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:? arch/x86/kvm/vmx/vmx.c:6606) kvm_intel vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890) __x64_sys_ioctl (fs/ioctl.c:890) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) value changed: 0x00000012 -> 0x00000000

HighCVSS 7.9Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A rare race condition in Linux KVM could make a virtualization host reference the wrong virtual CPU entry, potentially disrupting workloads or affecting data. The assigned severity is high, although the kernel description calls the required compiler store-tearing scenario extremely unlikely.

Executive priority

Schedule accelerated patching of affected KVM hosts according to workload criticality. High potential availability impact warrants action, but current evidence does not support emergency incident response solely for this CVE.

Technical view

Unsynchronized access to kvm->last_boosted_vcpu produced a KCSAN-detected data race. Theoretically, a torn store combined with a concurrent load could generate an out-of-bounds vcpu_array index. The fix uses READ_ONCE() and WRITE_ONCE() to make these accesses atomic.

Likely exposure

Exposure is limited to Linux hosts using KVM. The supplied version data names kernels from 2.6.39 through 6.10, but lacks sufficient range semantics to classify every build; map exact kernel packages through distribution or vendor advisories.

Exploitation context

The CVSS vector describes local, low-privilege access with no user interaction and potentially high availability impact. The supplied bundle marks KEV false, and no cited source reports exploitation in the wild. Practical exploitation remains uncertain and appears highly conditional.

Researcher notes

KCSAN established the underlying race, while the out-of-bounds consequence is presented as theoretical and dependent on compiler store tearing. Researchers should distinguish the confirmed concurrency defect from unconfirmed real-world exploitation or demonstrated security impact.

Mitigation direction

  • Apply a vendor-supported kernel update containing the referenced stable KVM fix.
  • Prioritize business-critical and multi-tenant KVM virtualization hosts.
  • If immediate updating is unavailable, consult the Linux distribution vendor; no alternative workaround is identified in the sources.

Validation and detection

  • Identify hosts where KVM is enabled and record their exact running kernel packages.
  • Confirm the installed update includes a referenced stable commit or is marked fixed by the distribution vendor.
  • After maintenance, verify each host booted into the corrected kernel.
  • In testing environments, check for KCSAN race reports involving kvm_vcpu_on_spin.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-40953 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.9 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
11Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.9CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H25.3Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.9High
CVSS 3.1 vector shape for CVE-2024-40953Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux217ece6129f2d3b4fdd18d9e79be9e43d8d14a42, 217ece6129f2d3b4fdd18d9e79be9e43d8d14a42, 217ece6129f2d3b4fdd18d9e79be9e43d8d14a42, 217ece6129f2d3b4fdd18d9e79be9e43d8d14a42, 217ece6129f2d3b4fdd18d9e79be9e43d8d14a42, 217ece6129f2d3b4fdd18d9e79be9e43d8d14a42, 217ece6129f2d3b4fdd18d9e79be9e43d8d14a42, 217ece6129f2d3b4fdd18d9e79be9e43d8d14a42unaffected
LinuxLinux2.6.39, 0, 4.19.323, 5.4.285, 5.10.228, 5.15.169, 6.1.96, 6.6.36, 6.9.7, 6.10affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.