From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6F22515B554 for ; Thu, 27 Feb 2025 02:13:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740622399; cv=none; b=Ps0fMjJb8FQtrSJNIjvB+aQiIS0kcLh8fNB2SBUV+8uAemwq7pAl5tsq/wvpvZak9lkJynm/3uK3oHbpwANF7BTXWKfpVZp5JhBTxogeRf8JVBWJFgd4KR4XWCdm1LSCS5aDHC2U2Y6iKDIvVOUN7lsZhRm/bEgw2FHDcJl57hE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740622399; c=relaxed/simple; bh=F/TB5MIRjAF3weg14UsOP2GS46dq1b/H1vCE74jC3YQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ZyEii0pYTql6mUNjnsM8pxGgp3cgG1EMFhUdVEvNW3cceLCW4beqQUAYKE9I2WZlT+Tr0UtJBrv82sIEdfTtAz+dEgrnmX6s13TNDUzl6ehDWvYZRjJNA17z1GdhlM4xLKEiF2RxnO/bcL+qokPpqUbo+gmd0QHh3J1yVR4Y/Os= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=LQxjbW6e; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="LQxjbW6e" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E0F8AC4CED6; Thu, 27 Feb 2025 02:13:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740622399; bh=F/TB5MIRjAF3weg14UsOP2GS46dq1b/H1vCE74jC3YQ=; h=From:To:Cc:Subject:Date:Reply-to:From; b=LQxjbW6euhXw+SvqtYytnZ/QI2elIMW2Mm9oCjLXhrlAtc+Tw9p6dVN52zOXkpRpw WHD6bBAF+a0mSLfn2kw+zfSEkMskRmpX5KmdiCLpqfsVmz+y0KMOrvBEZjUapZ48Dv PyyfnyaBBJIG5WU3ShpzRMn66ioD6VElK0bU9kcw= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2025-21740: KVM: x86/mmu: Ensure NX huge page recovery thread is alive before waking Date: Wed, 26 Feb 2025 18:11:22 -0800 Message-ID: <2025022659-CVE-2025-21740-083e@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=2622; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=F/TB5MIRjAF3weg14UsOP2GS46dq1b/H1vCE74jC3YQ=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7T27uv5qWtU+3aOKOlNl706+wLfrCanPmx73kua9L0 l2D5my51hHLwiDIxCArpsjyZRvP0f0VhxS9DG1Pw8xhZQIZwsDFKQATcXrLsKC31/7yv9VzUxIy N8QbR2R5VOnY8DDMFQqPSHMqWfR9NYfU+ysG218/+GElAgA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure NX huge page recovery thread is alive before waking When waking a VM's NX huge page recovery thread, ensure the thread is actually alive before trying to wake it. Now that the thread is spawned on-demand during KVM_RUN, a VM without a recovery thread is reachable via the related module params. BUG: kernel NULL pointer dereference, address: 0000000000000040 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:vhost_task_wake+0x5/0x10 Call Trace: set_nx_huge_pages+0xcc/0x1e0 [kvm] param_attr_store+0x8a/0xd0 module_attr_store+0x1a/0x30 kernfs_fop_write_iter+0x12f/0x1e0 vfs_write+0x233/0x3e0 ksys_write+0x60/0xd0 do_syscall_64+0x5b/0x160 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f3b52710104 Modules linked in: kvm_intel kvm CR2: 0000000000000040 The Linux kernel CVE team has assigned CVE-2025-21740 to this issue. Affected and fixed versions =========================== Issue introduced in 6.14-rc1 with commit 931656b9e2ff7029aee0b36e17780621948a6ac1 and fixed in 6.14-rc2 with commit 43fb96ae78551d7bfa4ecca956b258f085d67c40 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2025-21740 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: arch/x86/kvm/mmu/mmu.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/2b3928b7c896e5a9fb6b1373924adafe8e01a0c6 https://git.kernel.org/stable/c/974f85f1f7eb7dc7fce0988046e06eeccab576a7 https://git.kernel.org/stable/c/43fb96ae78551d7bfa4ecca956b258f085d67c40