Executive brief
A vulnerability was identified in the Linux kernel's virtualization component (KVM) that could lead to a system crash or unauthorized memory access. The issue occurs when the system incorrectly handles memory regions assigned to virtual machines while those regions are being closed or deleted. This could allow a local attacker to trigger a 'use-after-free' condition, potentially compromising the stability or security of the host operating system.
Technical details
A use-after-free vulnerability exists in virt/kvm/guest_memfd.c within the Linux kernel. The root cause is a failure to remove bindings during memslot deletion when the guest_memfd file is in a 'dying' state (refcount zero). If a memslot is freed before the file is fully released, kvm_gmem_release() attempts to nullify the memslot side of the binding, resulting in a write to already-freed memory. This was identified via KASAN as a slab-use-after-free. The fix involves ensuring bindings are removed during unbinding regardless of the file's lifecycle state. Patches have been released for stable kernel branches including 6.11.y and 6.12.y.
Affected products
- Linux Linux Kernel 6.8 to 6.12.1
Timeline
- 2025-11-03: patched: Initial patch authored by Sean Christopherson
- 2025-12-06: disclosed: CVE-2025-40274 published