CVE-2024-40953

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A data race vulnerability has been resolved in the Linux kernel's KVM module. The issue occurred in the kvm vcpu on spin() function, where a data race on last boosted vcpu could potentially allow KVM to attempt to get a vCPU using an out-of-bounds index. This could happen if the compiler tears the stores, and the write is split into multiple 8-bit stores, paired with a 32-bit load on a VM with 257 vCPUs. The vulnerability was detected by KCSAN.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.