CVE-2021-47092— KVM: VMX: Always clear vmx->fail on emulation_required
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于 KVM VMX中的 emulation_required存在安全问题。
Affected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | c8607e4a086fae05efe5bffb47c5199c65e7216e< e4e4e7cb229821cd215031abc47efdab5486a67c |
affected |
c8607e4a086fae05efe5bffb47c5199c65e7216e< a80dfc025924024d2c61a4c1b8ef62b2fce76a04 |
affected | ||
5.15 |
affected | ||
< 5.15 |
unaffected | ||
5.15.12≤ 5.15.* |
unaffected | ||
5.16≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-47092
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
KVM: VMX: Always clear vmx->fail on emulation_required
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
KVM: VMX: Always clear vmx->fail on emulation_required
Revert a relatively recent change that set vmx->fail if the vCPU is in L2
and emulation_required is true, as that behavior is completely bogus.
Setting vmx->fail and synthesizing a VM-Exit is contradictory and wrong:
(a) it's impossible to have both a VM-Fail and VM-Exit
(b) vmcs.EXIT_REASON is not modified on VM-Fail
(c) emulation_required refers to guest state and guest state checks are
always VM-Exits, not VM-Fails.
For KVM specifically, emulation_required is handled before nested exits
in __vmx_handle_exit(), thus setting vmx->fail has no immediate effect,
i.e. KVM calls into handle_invalid_guest_state() and vmx->fail is ignored.
Setting vmx->fail can ultimately result in a WARN in nested_vmx_vmexit()
firing when tearing down the VM as KVM never expects vmx->fail to be set
when L2 is active, KVM always reflects those errors into L1.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 21158 at arch/x86/kvm/vmx/nested.c:4548
nested_vmx_vmexit+0x16bd/0x17e0
arch/x86/kvm/vmx/nested.c:4547
Modules linked in:
CPU: 0 PID: 21158 Comm: syz-executor.1 Not tainted 5.16.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:nested_vmx_vmexit+0x16bd/0x17e0 arch/x86/kvm/vmx/nested.c:4547
Code: <0f> 0b e9 2e f8 ff ff e8 57 b3 5d 00 0f 0b e9 00 f1 ff ff 89 e9 80
Call Trace:
vmx_leave_nested arch/x86/kvm/vmx/nested.c:6220 [inline]
nested_vmx_free_vcpu+0x83/0xc0 arch/x86/kvm/vmx/nested.c:330
vmx_free_vcpu+0x11f/0x2a0 arch/x86/kvm/vmx/vmx.c:6799
kvm_arch_vcpu_destroy+0x6b/0x240 arch/x86/kvm/x86.c:10989
kvm_vcpu_destroy+0x29/0x90 arch/x86/kvm/../../../virt/kvm/kvm_main.c:441
kvm_free_vcpus arch/x86/kvm/x86.c:11426 [inline]
kvm_arch_destroy_vm+0x3ef/0x6b0 arch/x86/kvm/x86.c:11545
kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:1189 [inline]
kvm_put_kvm+0x751/0xe40 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1220
kvm_vcpu_release+0x53/0x60 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3489
__fput+0x3fc/0x870 fs/file_table.c:280
task_work_run+0x146/0x1c0 kernel/task_work.c:164
exit_task_work include/linux/task_work.h:32 [inline]
do_exit+0x705/0x24f0 kernel/exit.c:832
do_group_exit+0x168/0x2d0 kernel/exit.c:929
get_signal+0x1740/0x2120 kernel/signal.c:2852
arch_do_signal_or_restart+0x9c/0x730 arch/x86/kernel/signal.c:868
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x191/0x220 kernel/entry/common.c:207
__syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
syscall_exit_to_user_mode+0x2e/0x70 kernel/entry/common.c:300
do_syscall_64+0x53/0xd0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于 KVM VMX中的 emulation_required存在安全问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2021-47092
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-47092
请登录查看更多情报信息。
Other References for CVE-2021-47092 (2)
Same Patch Batch · Linux · 2024-03-04 · 26 CVEs total
| CVE-2021-47107 | 9.8 CRITICAL | NFSD: Fix READDIR buffer overflow |
| CVE-2021-47103 | 9.8 CRITICAL | inet: fully convert sk->sk_rx_dst to RCU rules |
| CVE-2021-47082 | 7.8 HIGH | tun: avoid double free in tun_free_netdev |
| CVE-2021-47087 | 7.8 HIGH | tee: optee: Fix incorrect page free bug |
| CVE-2021-47106 | 7.8 HIGH | netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy() |
| CVE-2021-47094 | 7.8 HIGH | KVM: x86/mmu: Don't advance iterator after restart due to yielding |
| CVE-2021-47099 | 7.8 HIGH | veth: ensure skb entering GRO are not cloned. |
| CVE-2021-47083 | 7.1 HIGH | pinctrl: mediatek: fix global-out-of-bounds issue |
| CVE-2021-47102 | 7.1 HIGH | net: marvell: prestera: fix incorrect structure access |
| CVE-2021-47096 | ALSA: rawmidi - fix the uninitalized user_pversion | |
| CVE-2021-47108 | drm/mediatek: hdmi: Perform NULL pointer check for mtk_hdmi_conf | |
| CVE-2021-47105 | ice: xsk: return xsk buffers back to pool when cleaning the ring | |
| CVE-2021-47104 | IB/qib: Fix memory leak in qib_user_sdma_queue_pkts() | |
| CVE-2021-47101 | asix: fix uninit-value in asix_mdio_read() | |
| CVE-2021-47100 | ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module | |
| CVE-2021-47098 | hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations | |
| CVE-2021-47097 | Input: elantech - fix stack out of bound access in elantech_change_report_id() | |
| CVE-2024-26622 | tomoyo: fix UAF write bug in tomoyo_write_control() | |
| CVE-2021-47095 | ipmi: ssif: initialize ssif_info->client early | |
| CVE-2021-47093 | platform/x86: intel_pmc_core: fix memleak on registration failure |
Showing top 20 of 26 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
Same vendor: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
V. Comments for CVE-2021-47092
No comments yet