KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes

{
  "id": "97ae6ff1ecf44013e675cb087a784be244c4f0152a67f61bd1dc24f03a184350",
  "url": "https://osv.dev/vulnerability/CVE-2024-26991",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes Fix KVM_SET_MEMORY_ATTRIBUTES to not overflow lpage_info array and trigger KASAN splat, as seen in the private_mem_conversions_test selftest. When memory attributes are set on a GFN range, that range will have specific properties applied to the TDP. A huge page cannot be used when the attributes are inconsistent, so they are disabled for those the specific huge pages. For internal KVM reasons, huge pages are also not allowed to span adjacent memslots regardless of whether the backing memory could be mapped as huge. What GFNs support which huge page sizes is tracked by an array of arrays 'lpage_info' on the memslot, of ‘kvm_lpage_info’ structs. Each index of lpage_info contains a vmalloc allocated array of these for a specific supported page size. The kvm_lpage_info denotes whether a specific huge page (GFN and page size) on the memslot is supported. These arrays include indices for unaligned head and tail huge pages. Preventing huge pages from spanning adjacent memslot is covered by incrementing the count in head and tail kvm_lpage_info when the memslot is allocated, but disallowing huge pages for memory that has mixed attributes has to be done in a more complicated way. During the KVM_SET_MEMORY_ATTRIBUTES ioctl KVM updates lpage_info for each memslot in the range that has mismatched attributes. KVM does this a memslot at a time, and marks",
    "evidence": "osv:CVE-2024-26991",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.8.8",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "CVE-2024-26991",
      "aliases": [
        "CVE-2024-26991"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "90b4fe17981e155432c4dbc490606d0c2e9c2199"
                },
                {
                  "fixed": "048cc4a028e635d339687ed968985d2d1669494c"
                },
                {
                  "fixed": "992b54bd083c5bee24ff7cc35991388ab08598c4"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26991.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.8.0"
                },
                {
                  "fixed": "6.8.8"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26991.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:32.288669625Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/048cc4a028e635d339687ed968985d2d1669494c",
        "https://git.kernel.org/stable/c/992b54bd083c5bee24ff7cc35991388ab08598c4",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26991.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2024-26991",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26991.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2024-26991",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 499315,
  "published_at": "2024-05-01T05:27:53.427+00:00"
}