CVE-2026-74607

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> KVM: SVM: Serialize accesses to the owner and mirror list with separate lock<br /> <br /> Interaction between KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM and<br /> KVM_CAP_VM_COPY_ENC_CONTEXT_FROM can cause two separate issues:<br /> <br /> - in sev_migrate_from(), when the destination KVM is a mirror, the mirror<br /> entry is moved from the source&amp;#39;s list to the owner&amp;#39;s mirror_vms list,<br /> without holding the owner&amp;#39;s lock unlike other writers of the owner&amp;#39;s<br /> mirror list (sev_vm_copy_enc_context_from(), sev_vm_destroy()).<br /> A concurrent COPY or destroy can race with sev_migrate_from() and<br /> corrupt the list.<br /> <br /> - In sev_vm_destroy(), the *owner* is still active and could receive<br /> concurrently a KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM that causes<br /> sev-&gt;enc_context_owner to change. In this case the incorrect VM<br /> receives kvm_put_kvm().<br /> <br /> The second issue needs particular care because the owner could disappear<br /> altogether (even though the race window is impossibly small) between<br /> reading it and locking it. There is thus no way to perform the checks<br /> under the owner lock without putting struct kvm under SLAB_TYPESAFE_BY_RCU<br /> (which would allow kvm_get_kvm_safe() under RCU critical section).<br /> <br /> It is much simpler to just use a global lock, since the critical<br /> sections are so small and the new lock is always a leaf lock.