CVE-2024-57793virt: tdx-guest: Just leak decrypted memory on unrecoverable errors
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors In CoCo VMs it is possible for the untrusted host to cause set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. Leak the decrypted memory when set_memory_decrypted() fails, and don't need to print an error since set_memory_decrypted() will call WARN_ONCE().
- CVSS
- 9.3 CRITICAL (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from f4738f56d1dc62aaba69b33702a5ab098f1b8c63 before 1429ae7b7d4759a1e362456b8911c701bae655b4; from f4738f56d1dc62aaba69b33702a5ab098f1b8c63 before 27834971f616c5e154423c578fa95e0444444ce1 | CNA record |
linux linux_kernel linux:linux_kernel | from 6.7 before 6.12.8; 6.13; 6.13; 6.13; 6.13 | NVD |
References
- https://git.kernel.org/stable/c/1429ae7b7d4759a1e362456b8911c701bae655b4patch
- https://git.kernel.org/stable/c/27834971f616c5e154423c578fa95e0444444ce1patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.