---
id: CVE-2024-53195
title: 'KVM: arm64: Get rid of userspace_irqchip_in_use'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: arm64: Get rid of userspace_irqchip_in_use

  Improper use of userspace_irqchip_in_use led to syzbot hitting the
  following WARN_ON() in kvm_timer_update_irq():

  WARN…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 6211753fdfd05af9e08f54c8d0ba3ee516034878 <
    982a1461ab9cf3146302fe5a139ecb1f9b2d33fc
  - >-
    Linux >= 6211753fdfd05af9e08f54c8d0ba3ee516034878 <
    dd2f9861f27571d47998d71e7516bf7216db0b52
  - >-
    Linux >= 6211753fdfd05af9e08f54c8d0ba3ee516034878 <
    c16e2dba39ff6ae84bb8dc9c8e0fb21d9b2f6f5c
  - >-
    Linux >= 6211753fdfd05af9e08f54c8d0ba3ee516034878 <
    fe425d5239a28c21e0c83ee7a8f4cb210d29fdb4
  - >-
    Linux >= 6211753fdfd05af9e08f54c8d0ba3ee516034878 <
    38d7aacca09230fdb98a34194fec2af597e8e20d
  - Linux 3.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:28:17.466515Z'
published: '2024-12-27'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:31:22.916Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-53195'
references:
  - url: 'https://git.kernel.org/stable/c/982a1461ab9cf3146302fe5a139ecb1f9b2d33fc'
  - url: 'https://git.kernel.org/stable/c/dd2f9861f27571d47998d71e7516bf7216db0b52'
  - url: 'https://git.kernel.org/stable/c/c16e2dba39ff6ae84bb8dc9c8e0fb21d9b2f6f5c'
  - url: 'https://git.kernel.org/stable/c/fe425d5239a28c21e0c83ee7a8f4cb210d29fdb4'
  - url: 'https://git.kernel.org/stable/c/38d7aacca09230fdb98a34194fec2af597e8e20d'
tags:
  - cve.org
epss: 0.0022
epssPercentile: 0.12577
ingestedAt: '2026-11-03T14:47:02.518Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Get rid of userspace_irqchip_in_use

Improper use of userspace_irqchip_in_use led to syzbot hitting the
following WARN_ON() in kvm_timer_update_irq():

WARNING: CPU: 0 PID: 3281 at arch/arm64/kvm/arch_timer.c:459
kvm_timer_update_irq+0x21c/0x394
Call trace:
  kvm_timer_update_irq+0x21c/0x394 arch/arm64/kvm/arch_timer.c:459
  kvm_timer_vcpu_reset+0x158/0x684 arch/arm64/kvm/arch_timer.c:968
  kvm_reset_vcpu+0x3b4/0x560 arch/arm64/kvm/reset.c:264
  kvm_vcpu_set_target arch/arm64/kvm/arm.c:1553 [inline]
  kvm_arch_vcpu_ioctl_vcpu_init arch/arm64/kvm/arm.c:1573 [inline]
  kvm_arch_vcpu_ioctl+0x112c/0x1b3c arch/arm64/kvm/arm.c:1695
  kvm_vcpu_ioctl+0x4ec/0xf74 virt/kvm/kvm_main.c:4658
  vfs_ioctl fs/ioctl.c:51 [inline]
  __do_sys_ioctl fs/ioctl.c:907 [inline]
  __se_sys_ioctl fs/ioctl.c:893 [inline]
  __arm64_sys_ioctl+0x108/0x184 fs/ioctl.c:893
  __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
  invoke_syscall+0x78/0x1b8 arch/arm64/kernel/syscall.c:49
  el0_svc_common+0xe8/0x1b0 arch/arm64/kernel/syscall.c:132
  do_el0_svc+0x40/0x50 arch/arm64/kernel/syscall.c:151
  el0_svc+0x54/0x14c arch/arm64/kernel/entry-common.c:712
  el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
  el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598

The following sequence led to the scenario:
 - Userspace creates a VM and a vCPU.
 - The vCPU is initialized with KVM_ARM_VCPU_PMU_V3 during
   KVM_ARM_VCPU_INIT.
 - Without any other setup, such as vGIC or vPMU, userspace issues
   KVM_RUN on the vCPU. Since the vPMU is requested, but not setup,
   kvm_arm_pmu_v3_enable() fails in kvm_arch_vcpu_run_pid_change().
   As a result, KVM_RUN returns after enabling the timer, but before
   incrementing 'userspace_irqchip_in_use':
   kvm_arch_vcpu_run_pid_change()
       ret = kvm_arm_pmu_v3_enable()
           if (!vcpu->arch.pmu.created)
               return -EINVAL;
       if (ret)
           return ret;
       [...]
       if (!irqchip_in_kernel(kvm))
           static_branch_inc(&userspace_irqchip_in_use);
 - Userspace ignores the error and issues KVM_ARM_VCPU_INIT again.
   Since the timer is already enabled, control moves through the
   following flow, ultimately hitting the WARN_ON():
   kvm_timer_vcpu_reset()
       if (timer->enabled)
          kvm_timer_update_irq()
              if (!userspace_irqchip())
                  ret = kvm_vgic_inject_irq()
                      ret = vgic_lazy_init()
                          if (unlikely(!vgic_initialized(kvm)))
                              if (kvm->arch.vgic.vgic_model !=
                                  KVM_DEV_TYPE_ARM_VGIC_V2)
                                      return -EBUSY;
                  WARN_ON(ret);

Theoretically, since userspace_irqchip_in_use's functionality can be
simply replaced by '!irqchip_in_kernel()', get rid of the static key
to avoid the mismanagement, which also helps with the syzbot issue.

## Affected

- `Linux >= 6211753fdfd05af9e08f54c8d0ba3ee516034878 < 982a1461ab9cf3146302fe5a139ecb1f9b2d33fc`
- `Linux >= 6211753fdfd05af9e08f54c8d0ba3ee516034878 < dd2f9861f27571d47998d71e7516bf7216db0b52`
- `Linux >= 6211753fdfd05af9e08f54c8d0ba3ee516034878 < c16e2dba39ff6ae84bb8dc9c8e0fb21d9b2f6f5c`
- `Linux >= 6211753fdfd05af9e08f54c8d0ba3ee516034878 < fe425d5239a28c21e0c83ee7a8f4cb210d29fdb4`
- `Linux >= 6211753fdfd05af9e08f54c8d0ba3ee516034878 < 38d7aacca09230fdb98a34194fec2af597e8e20d`
- `Linux 3.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.