Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U N N H 5.5 .0023 14.6 —
AFFECTED Product Versions Fixed Linux d97c0667c1e61ded6639117b4b9584a9c12b7e66 – — Linux 5.19 – 5.15.154
TIMELINE May 17 Reserved by Linux May 17 Published (CNA: Linux) Aug 4 RESCORED — CVE-2024-35804 (Linux). CVSS 8.8 → 5.5 (NVD).
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Mark target gfn of emulated atomic instruction as dirty When emulating an atomic access on behalf of the guest, mark the target gfn dirty if the CMPXCHG by KVM is attempted and doesn't fault. This fixes a bug where KVM effectively corrupts guest memory during live migration by writing to guest memory without informing userspace that the page is dirty. Marking the page dirty got unintentionally dropped when KVM's emulated CMPXCHG was converted to do a user access. Before that, KVM explicitly mapped the guest page into kernel memory, and marked the page dirty during the unmap phase. Mark the page dirty even if the CMPXCHG fails, as the old data is written back on failure, i.e. the page is still written. The value written is guaranteed to be the same because the operation is atomic, but KVM's ABI is that all writes are dirty logged regardless of the value written. And more importantly, that's what KVM did before the buggy commit. Huge kudos to the folks on the Cc list (and many others), who did all the actual work of triaging and debugging. base-commit: 6769ea8da8a93ed4630f1ce64df6aafcaabfce64
| Date | Event | Detail |
|---|---|---|
| May 17, 2024 | Reserved | Reserved by Linux |
| May 17, 2024 | Published | Published (CNA: Linux) |
| August 4, 2026 | RESCORED | RESCORED — CVE-2024-35804 (Linux). CVSS 8.8 → 5.5 (NVD). |
Authoritative record: CVE-2024-35804 at cve.org
Vendors: linux
Weaknesses: CWE-401
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-35804 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.