In the Linux kernel, the following vulnerability has been resolved: KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls kvmxenschedoppoll does a kmallocarray() when a VM polls the host for more than one event channel potr (nrports > 1). After the kmallocarray(), the error paths need to go through the "out" label, but the call to kvmreadguest_virt() does not. [Adjusted commit message. - Paolo]