VYPR
← All advisories
Unrated severityNVD Advisory· Published Feb 15, 2019· Updated Aug 4, 2024

CVE-2019-6974

CVE-2019-6974

Description

In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.

Affected products

145

Patches

2
cfa39381173d

kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)

https://github.com/torvalds/linuxJann HornJan 26, 2019via osv
commit
1 file changed · +2 −1
  • virt/kvm/kvm_main.c+2 −1 modified
    @@ -3000,16 +3000,17 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
 	if (ops->init)
 		ops->init(dev);
 
+	kvm_get_kvm(kvm);
 	ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC);
 	if (ret < 0) {
+		kvm_put_kvm(kvm);
 		mutex_lock(&kvm->lock);
 		list_del(&dev->vm_node);
 		mutex_unlock(&kvm->lock);
 		ops->destroy(dev);
 		return ret;
 	}
 
-	kvm_get_kvm(kvm);
 	cd->fd = ret;
 	return 0;
 }
cfa39381173d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitvia osv
commit

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

28

News mentions

0

No linked articles in our index yet.