---
id: CVE-2024-55881
title: 'KVM: x86: Play nice with protected guests in complete_hypercall_exit()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: x86: Play nice with protected guests in complete_hypercall_exit()

  Use is_64_bit_hypercall() instead of is_64_bit_mode() to detect a 64-bit
  hypercall when completi…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5969e2435cbd7f0ce8c28d717bfc39987ee8d8f1 <
    0840d360a8909c722fb62459f42836afe32ededb
  - >-
    Linux >= b5aead0064f33ae5e693a364e3204fe1c0ac9af2 <
    7ed4db315094963de0678a8adfd43c46471b9349
  - >-
    Linux >= b5aead0064f33ae5e693a364e3204fe1c0ac9af2 <
    3d2634ec0d1dbe8f4b511cf5261f327c6a76f4b6
  - >-
    Linux >= b5aead0064f33ae5e693a364e3204fe1c0ac9af2 <
    22b5c2acd65dbe949032f619d4758a35a82fffc3
  - >-
    Linux >= b5aead0064f33ae5e693a364e3204fe1c0ac9af2 <
    9b42d1e8e4fe9dc631162c04caa69b0d1860b0f0
  - Linux >= 5.15.5 < 5.15.176
  - Linux 5.16
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:28:39.976365Z'
published: '2025-01-11'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:31:23.729Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-55881'
references:
  - url: 'https://git.kernel.org/stable/c/0840d360a8909c722fb62459f42836afe32ededb'
  - url: 'https://git.kernel.org/stable/c/7ed4db315094963de0678a8adfd43c46471b9349'
  - url: 'https://git.kernel.org/stable/c/3d2634ec0d1dbe8f4b511cf5261f327c6a76f4b6'
  - url: 'https://git.kernel.org/stable/c/22b5c2acd65dbe949032f619d4758a35a82fffc3'
  - url: 'https://git.kernel.org/stable/c/9b42d1e8e4fe9dc631162c04caa69b0d1860b0f0'
tags:
  - cve.org
epss: 0.00209
epssPercentile: 0.11066
ingestedAt: '2026-11-05T22:38:31.832Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Play nice with protected guests in complete_hypercall_exit()

Use is_64_bit_hypercall() instead of is_64_bit_mode() to detect a 64-bit
hypercall when completing said hypercall.  For guests with protected state,
e.g. SEV-ES and SEV-SNP, KVM must assume the hypercall was made in 64-bit
mode as the vCPU state needed to detect 64-bit mode is unavailable.

Hacking the sev_smoke_test selftest to generate a KVM_HC_MAP_GPA_RANGE
hypercall via VMGEXIT trips the WARN:

  ------------[ cut here ]------------
  WARNING: CPU: 273 PID: 326626 at arch/x86/kvm/x86.h:180 complete_hypercall_exit+0x44/0xe0 [kvm]
  Modules linked in: kvm_amd kvm ... [last unloaded: kvm]
  CPU: 273 UID: 0 PID: 326626 Comm: sev_smoke_test Not tainted 6.12.0-smp--392e932fa0f3-feat #470
  Hardware name: Google Astoria/astoria, BIOS 0.20240617.0-0 06/17/2024
  RIP: 0010:complete_hypercall_exit+0x44/0xe0 [kvm]
  Call Trace:
   <TASK>
   kvm_arch_vcpu_ioctl_run+0x2400/0x2720 [kvm]
   kvm_vcpu_ioctl+0x54f/0x630 [kvm]
   __se_sys_ioctl+0x6b/0xc0
   do_syscall_64+0x83/0x160
   entry_SYSCALL_64_after_hwframe+0x76/0x7e
   </TASK>
  ---[ end trace 0000000000000000 ]---

## Affected

- `Linux >= 5969e2435cbd7f0ce8c28d717bfc39987ee8d8f1 < 0840d360a8909c722fb62459f42836afe32ededb`
- `Linux >= b5aead0064f33ae5e693a364e3204fe1c0ac9af2 < 7ed4db315094963de0678a8adfd43c46471b9349`
- `Linux >= b5aead0064f33ae5e693a364e3204fe1c0ac9af2 < 3d2634ec0d1dbe8f4b511cf5261f327c6a76f4b6`
- `Linux >= b5aead0064f33ae5e693a364e3204fe1c0ac9af2 < 22b5c2acd65dbe949032f619d4758a35a82fffc3`
- `Linux >= b5aead0064f33ae5e693a364e3204fe1c0ac9af2 < 9b42d1e8e4fe9dc631162c04caa69b0d1860b0f0`
- `Linux >= 5.15.5 < 5.15.176`
- `Linux 5.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.