CVE-2021-47062
KVM: SVM: Use online_vcpus, not created_vcpus, to iterate over vCPUs
Reported by linux · Published February 29, 2024
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Use online_vcpus, not created_vcpus, to iterate over vCPUs Use the kvm_for_each_vcpu() helper to iterate over vCPUs when encrypting VMSAs for SEV, which effectively switches to use online_vcpus instead of created_vcpus. This fixes a possible null-pointer dereference as created_vcpus does not guarantee a vCPU exists, since it is updated at the very beginning of KVM_CREATE_VCPU. created_vcpus exists to allow the bulk of vCPU creation to run in parallel, while still correctly restricting the max number of max vCPUs.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| Linux | Linux | bd0cced2ae93195668f983d443f7f17e8efd24d2 |
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | ad73109ae7ec30d5bfb76be108e304f9f0af4829, ad73109ae7ec30d5bfb76be108e304f9f0af4829, ad73109ae7ec30d5bfb76be108e304f9f0af4829 |
| Linux | Linux | 5.11, 0, 5.11.21 |
| Linux | Linux | *, 5.11, * |
| linux | linux_kernel | 5.11, 5.11, 5.11 |
Timeline
- Feb 29, 2024 CVE Published
- Mar 1, 2024 EPSS Score (30 in total, the first dated here)
- Mar 1, 2024 PoC Published (2 in total, the first dated here)
- Apr 29, 2026 Security Advisory (131 in total, the first dated here)
- Jul 13, 2026 Coalition ESS Score
- Aug 4, 2026 CVE Updated
- Aug 10, 2026 Distribution Patch (93 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2021-47062
vulnetix vdb fixes CVE-2021-47062Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-47062/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart