CVE-2024-26691: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26691 affects the Linux kernel's KVM (Kernel Virtual Machine) implementation on ARM64 architecture. The vulnerability was discovered and reported in early 2024, involving a circular locking dependency issue in the KVM subsystem. The vulnerability affects Linux kernel versions from 6.7 and earlier versions before 6.7.6, as well as various release candidates of version 6.8 (NVD).

The vulnerability stems from a circular locking dependency in the ARM64 KVM implementation. The issue occurs because the rule inside KVM enforces that the vcpu->mutex should be taken inside kvm->lock, but this rule is violated by the pkvm_create_hyp_vm() function which acquires the kvm->lock while already holding the vcpu->mutex lock from kvm_vcpu_ioctl(). The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD, Kernel Patch).

The vulnerability can lead to system instability or potential deadlocks due to the circular locking dependency in the KVM subsystem. While there is no direct impact on confidentiality or integrity, the availability of the system could be affected, particularly in environments utilizing KVM virtualization on ARM64 architectures (NVD).

The vulnerability requires local access and low privileges to exploit. There are no known public exploits at the time of assessment, and the vulnerability requires specific conditions related to KVM usage on ARM64 systems (NVD).

The vulnerability has been fixed by modifying the locking mechanism to protect the hyp vm handle with the config_lock instead of using the previous locking scheme. The fix has been implemented in kernel version 6.7.6 and later versions. System administrators should update their Linux kernel to a patched version to address this vulnerability (Kernel Patch).