CVE-2024-26617

What it actually does

Race condition in Linux kernel proc/task_mmu mmu notification that allows concurrent invalidation of varying memory ranges outside mm lock, triggering warnings in dependent components such as KVM mmu notifier.

Why it matters to the business

Low operational risk on systems without registered mmu notifiers; potential instability or warnings on KVM/virtualization workloads until kernel is updated, with no known ransomware or active campaigns increasing urgency.

How an attack unfolds

An attacker with local access would attempt to trigger concurrent memory-management operations that race with mmu notifier callbacks to produce inconsistent range invalidations, though low EPSS and absence from KEV indicate exploitation is unlikely in practice.

How to fix it

Upgrade Linux kernel packages to fixed versions: Debian 12/13 to 6.1.7-1 or later; mainline/stable git trees to commit ead3e6c79479890444c777fd329afc125fecde48 or newer equivalent.

How to confirm the fix worked

Confirm running kernel version matches or exceeds the listed fixed releases; reproduce workload that previously triggered the KVM warning and verify it no longer occurs.

Typical attack path

1. Obtain local execution on a vulnerable Linux kernel
2. Trigger parallel mmu operations and notifier callbacks
3. Observe or induce KVM warning and potential memory inconsistency

How to detect it

Search kernel logs and dmesg for the string "kvm_mmu_notifier_change_pte" and the associated WARNING at arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 on systems still running older kernels.

• kvm_mmu_notifier_change_pte+0x860/0x960
• WARNING: CPU: .* PID: .* at arch/x86/kvm/../../../virt/kvm/kvm_main.c:734

What your security team should do

• Apply kernel updates to all affected Debian and upstream systems according to the listed fixed versions
• Include the update in the next patch cycle given stable low EPSS and no KEV listing
• Monitor kernel logs for the removed KVM mmu notifier warning during validation