Bug 2348628 (CVE-2025-21740) - CVE-2025-21740 kernel: KVM: x86/mmu: Ensure NX huge page recovery thread is alive before waking
Summary: CVE-2025-21740 kernel: KVM: x86/mmu: Ensure NX huge page recovery thread is a...
Keywords:
Status: NEW
Alias: CVE-2025-21740
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-02-27 03:05 UTC by OSIDB Bzimport
Modified: 2025-06-13 10:26 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-02-27 03:05:39 UTC
In the Linux kernel, the following vulnerability has been resolved:

KVM: x86/mmu: Ensure NX huge page recovery thread is alive before waking

When waking a VM's NX huge page recovery thread, ensure the thread is
actually alive before trying to wake it.  Now that the thread is spawned
on-demand during KVM_RUN, a VM without a recovery thread is reachable via
the related module params.

  BUG: kernel NULL pointer dereference, address: 0000000000000040
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
  RIP: 0010:vhost_task_wake+0x5/0x10
  Call Trace:
   <TASK>
   set_nx_huge_pages+0xcc/0x1e0 [kvm]
   param_attr_store+0x8a/0xd0
   module_attr_store+0x1a/0x30
   kernfs_fop_write_iter+0x12f/0x1e0
   vfs_write+0x233/0x3e0
   ksys_write+0x60/0xd0
   do_syscall_64+0x5b/0x160
   entry_SYSCALL_64_after_hwframe+0x4b/0x53
  RIP: 0033:0x7f3b52710104
   </TASK>
  Modules linked in: kvm_intel kvm
  CR2: 0000000000000040

Comment 2 TEJ RATHI 2025-05-15 07:42:26 UTC
This CVE has been rejected upstream: https://lore.kernel.org/linux-cve-announce/2025032750-REJECTED-eafd@gregkh/


Note You need to log in before you can comment on or make changes to this bug.