CVE-2024-26990

What it actually does

TDP MMU SPTEs for L2 guests are not write-protected when kvm_mmu_page_ad_need_write_protect() requires it, allowing D-bit clearing instead of protection and causing L2 writes to bypass dirty logging when PML is enabled under L1 with EPT disabled.

Why it matters to the business

Nested virtualization environments using KVM may experience silent loss of dirty page tracking, leading to incomplete VM live migration, backup, or snapshot operations and potential data inconsistency in production workloads.

How an attack unfolds

An attacker with control of an L2 guest under a misconfigured L1 hypervisor (EPT disabled, PML enabled) triggers repeated writes to guest memory; because the TDP MMU clears D-bits instead of write-protecting SPTEs, those writes are omitted from the dirty log, allowing the attacker to hide memory modifications from the hypervisor.

How to fix it

Upgrade the Linux kernel to commit cdf811a937471af2d1facdf8ae80e5e68096f1ed or later stable releases that include the fix; apply the patch that checks kvm_mmu_page_ad_need_write_protect() before deciding whether to write-protect TDP MMU SPTEs.

How to confirm the fix worked

After patching, boot a nested L2 guest with EPT disabled and PML enabled, perform writes inside L2, and confirm that the corresponding pages now appear in the dirty log on the host.

Typical attack path

1. Configure L1 to disable EPT while leaving PML enabled for the L2 domain
2. Launch L2 guest under KVM TDP MMU
3. Perform writes inside L2 to pages that should be tracked
4. Observe absence of corresponding dirty log entries on the host

How to detect it

Review KVM dirty logging code paths and hypervisor logs for L2 guests running with EPT disabled; look for missing dirty page notifications during live migration or snapshot operations on affected kernel versions.

What your security team should do

• Prioritize kernel upgrades on all hosts running KVM with nested virtualization enabled
• Audit hypervisor configurations that disable EPT or enable PML for L2 guests
• Monitor EPSS and KEV status for any future changes indicating increased exploitability