In the Linux kernel, the following vulnerability has been resolved:
Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted
In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues.
The VMBus ring buffer code could free decrypted/shared pages if set_memory_decrypted() fails. Check the decrypted field in the struct vmbus_gpadl for the ring buffers to decide whether to free the memory.
CVSS Details
- CVSS 3.1 Base Score: 9.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernelUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-libbpf-develUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade python3-perfUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-modules-extraUpgrade kernel-develUpgrade kernel-libbpfUpgrade bpftoolUpgrade python3-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade kernel-libbpf-staticUpgrade kernel-modules-extra-commonUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-6.1.91-99.172 | Jun 11, 2025 | May 30, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 30, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 30, 2024 |
| Suse | — | Upgrade dtb-sprdUpgrade kselftests-kmp-defaultUpgrade dtb-broadcomUpgrade dtb-freescaleUpgrade dtb-amazonUpgrade kernel-64kb-optionalUpgrade kernel-kvmsmall-vdsoUpgrade cluster-md-kmp-64kbUpgrade kernel-symsUpgrade dtb-hisiliconUpgrade kernel-rt-optionalUpgrade dlm-kmp-rtUpgrade kernel-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade ocfs2-kmp-64kbUpgrade dtb-marvellUpgrade kernel-debug-develUpgrade kernel-default-develUpgrade kernel-azure-extraUpgrade kernel-docsUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-amdUpgrade gfs2-kmp-64kbUpgrade kselftests-kmp-rtUpgrade reiserfs-kmp-64kbUpgrade kernel-rt_debug-vdsoUpgrade kernel-debug-livepatch-develUpgrade kernel-rt_debug-develUpgrade reiserfs-kmp-defaultUpgrade kernel-debugUpgrade dlm-kmp-azureUpgrade kselftests-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade kernel-rt-livepatch-develUpgrade ocfs2-kmp-azureUpgrade kernel-64kbUpgrade dtb-socionextUpgrade dtb-allwinnerUpgrade kernel-default-livepatchUpgrade dtb-renesasUpgrade kernel-azure-vdsoUpgrade kernel-syms-rtUpgrade reiserfs-kmp-rtUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-extraUpgrade kernel-docs-htmlUpgrade dlm-kmp-defaultUpgrade kernel-64kb-develUpgrade kernel-default-baseUpgrade kernel-64kb-livepatch-develUpgrade dtb-appleUpgrade kernel-source-rtUpgrade kernel-rt_debugUpgrade kernel-azure-optionalUpgrade dtb-mediatekUpgrade dtb-apmUpgrade reiserfs-kmp-azureUpgrade cluster-md-kmp-azureUpgrade kernel-macrosUpgrade dtb-lgUpgrade dtb-armUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-vdsoUpgrade kernel-rt-livepatchUpgrade kernel-syms-azureUpgrade kernel-rt-develUpgrade dtb-exynosUpgrade kernel-develUpgrade kernel-default-base-rebuildUpgrade dtb-rockchipUpgrade cluster-md-kmp-rtUpgrade kselftests-kmp-64kbUpgrade kernel-rt-extraUpgrade kernel-default-extraUpgrade ocfs2-kmp-rtUpgrade gfs2-kmp-rtUpgrade kernel-rtUpgrade dtb-xilinxUpgrade dlm-kmp-64kbUpgrade gfs2-kmp-azureUpgrade kernel-zfcpdumpUpgrade kernel-source-vanillaUpgrade kernel-sourceUpgrade kernel-obs-buildUpgrade kernel-default-vdsoUpgrade kernel-kvmsmall-develUpgrade dtb-qcomUpgrade dtb-nvidiaUpgrade kernel-obs-qaUpgrade dtb-caviumUpgrade dtb-alteraUpgrade kernel-debug-vdsoUpgrade kernel-kvmsmallUpgrade kernel-azure-livepatch-develUpgrade kernel-azureUpgrade kernel-devel-azureUpgrade kernel-default-optionalUpgrade kernel-source-azureUpgrade kernel-azure-develUpgrade dtb-amlogicUpgrade kernel-devel-rt | Aug 8, 2024 | May 30, 2024 |
| Ubuntu | — | Upgrade linux-image-genericUpgrade linux-image-6.8.0-40-lowlatency-64kUpgrade linux-image-6.8.0-1011-nvidia-64kUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1012-azure-fdeUpgrade linux-image-6.8.0-40-generic-64kUpgrade linux-image-raspiUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1012-gcpUpgrade linux-image-generic-lpaeUpgrade linux-image-lowlatency-64kUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1012-azureUpgrade linux-image-ibm-classicUpgrade linux-image-azureUpgrade linux-image-nvidia-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1010-ibmUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1013-awsUpgrade linux-image-6.8.0-1010-oemUpgrade linux-image-ibmUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-40-genericUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1010-oracleUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1008-gkeUpgrade linux-image-awsUpgrade linux-image-gkeUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1011-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1009-raspiUpgrade linux-image-gcpUpgrade linux-image-kvmUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1010-oracle-64kUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1011-nvidia-lowlatencyUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oem-24.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-virtualUpgrade linux-image-6.8.0-40-lowlatency | Aug 9, 2024 | May 30, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 10, 2025 | May 30, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub