In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mmu: make apf token non-zero to fix bug
In current async pagefault logic, when a page is ready, KVM relies on kvm_arch_can_dequeue_async_page_present() to determine whether to deliver a READY event to the Guest. This function test token value of struct kvm_vcpu_pv_apf_data, which must be reset to zero by Guest kernel when a READY event is finished by Guest. If value is zero meaning that a READY event is done, so the KVM can deliver another. But the kvm_arch_setup_async_pf() may produce a valid token with zero value, which is confused with previous mention and may lead the loss of this READY event.
This bug may cause task blocked forever in Guest: INFO: task stress:7532 blocked for more than 1254 seconds. Not tainted 5.10.0 #16 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:stress state:D stack: 0 pid: 7532 ppid: 1409 flags:0x00000080 Call Trace: __schedule+0x1e7/0x650 schedule+0x46/0xb0 kvm_async_pf_task_wait_schedule+0xad/0xe0 ? exit_to_user_mode_prepare+0x60/0x70 __kvm_handle_async_pf+0x4f/0xb0 ? asm_exc_page_fault+0x8/0x30 exc_page_fault+0x6f/0x110 ? asm_exc_page_fault+0x8/0x30 asm_exc_page_fault+0x1e/0x30 RIP: 0033:0x402d00 RSP: 002b:00007ffd31912500 EFLAGS: 00010206 RAX: 0000000000071000 RBX: ffffffffffffffff RCX: 00000000021a32b0 RDX: 000000000007d011 RSI: 000000000007d000 RDI: 00000000021262b0 RBP: 00000000021262b0 R08: 0000000000000003 R09: 0000000000000086 R10: 00000000000000eb R11: 00007fefbdf2baa0 R12: 0000000000000000 R13: 0000000000000002 R14: 000000000007d000 R15: 0000000000001000
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-headersUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-livepatch-5.10.106-102.504Upgrade python-perfUpgrade python-perf-debuginfoUpgrade bpftoolUpgrade perfUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernelUpgrade kernel-tools-debuginfoUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64 | Sep 16, 2024 | Aug 22, 2024 |
| Debian | — | Upgrade linux | Aug 23, 2024 | Aug 22, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernelUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade python3-perf | Nov 11, 2024 | Aug 22, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel | Nov 11, 2024 | Aug 22, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Aug 22, 2024 |
| Ubuntu | — | Upgrade linux-image-oracleUpgrade linux-image-awsUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-serverUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-kvmUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-5.4.0-1045-iotUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-4.15.0-1168-gcpUpgrade linux-image-4.15.0-1137-oracleUpgrade linux-image-4.4.0-1139-kvmUpgrade linux-image-4.15.0-1183-azureUpgrade linux-image-5.4.0-1136-awsUpgrade linux-image-gcpUpgrade linux-image-5.4.0-1142-azureUpgrade linux-image-aws-lts-20.04Upgrade linux-image-aws-hweUpgrade linux-image-5.4.0-1120-raspiUpgrade linux-image-bluefieldUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.4.0-202-generic-lpaeUpgrade linux-image-raspi2Upgrade linux-image-5.4.0-202-lowlatencyUpgrade linux-image-4.15.0-1158-kvmUpgrade linux-image-5.4.0-1140-gcpUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-4.4.0-1176-awsUpgrade linux-image-5.4.0-1055-xilinx-zynqmpUpgrade linux-image-5.4.0-1124-kvmUpgrade linux-image-genericUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-aws-lts-18.04Upgrade linux-image-azure-lts-18.04Upgrade linux-image-4.4.0-261-lowlatencyUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-azure-lts-20.04Upgrade linux-image-azureUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-generic-lts-trustyUpgrade linux-image-3.13.0-200-genericUpgrade linux-image-virtualUpgrade linux-image-4.15.0-231-lowlatencyUpgrade linux-image-lowlatencyUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-gkeUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-oemUpgrade linux-image-3.13.0-200-lowlatencyUpgrade linux-image-5.4.0-202-genericUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-generic-lts-xenialUpgrade linux-image-oem-osp1Upgrade linux-image-ibmUpgrade linux-image-generic-lpaeUpgrade linux-image-5.4.0-1083-ibmUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-5.4.0-1135-oracleUpgrade linux-image-4.4.0-1138-awsUpgrade linux-image-4.4.0-261-genericUpgrade linux-image-raspiUpgrade linux-image-5.4.0-1096-bluefieldUpgrade linux-image-4.15.0-1175-awsUpgrade linux-image-4.15.0-231-genericUpgrade linux-image-snapdragon-hwe-18.04 | Nov 19, 2024 | Aug 22, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Aug 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub