KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits (Linux Linux)

CVE-2026-64284
HIGH 7.1

En bref

Source
NVD
EPSS
EPSS 0.13 % · centile 3 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Linux
Statut NVD
Modified

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Move the handling of fastpath userspace exits into vendor code to ensure KVM runs vendor specific operations that need to run before userspace gains control of the vCPU. E.g. for VMX (and soon to be for SVM as well), KVM needs to flush the PML buffer prior to exiting to userspace, otherwise any memory written by the final KVM_RUN might never be flagged as dirty. Note, waiting to snapshot CR0 and CR3 until svm_handle_exit() is flawed in general, as that risks consuming stale state in a fastpath handler. That will be addressed in a future change.

Faiblesses (CWE)

  • CWE-362 — Situation de compétition
  • CWE-367 — Situation de compétition TOCTOU

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HLinux
CVSS 3.1HIGH 7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HNVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Linux · Linuxaffected f7f39c50edb9d336274371953275e0d3503b9b75 < b3436d9b9b1affe1c3191ac9831308923f5f03c3 ; affected f7f39c50edb9d336274371953275e0d3503b9b75 < 4ad73ef0e7966ecfe67de0060537b4cb14d9acd4 ; affected f7f39c50edb9d336274371953275e0d3503b9b75 < f2ca2b5326211bd38490f0497eb583721ce0bbc0 ; affected f7f39c50edb9d336274371953275e0d3503b9b75 < 0ffedf43910e44b76c2c1db4e9fbf12b268190c1
Linux · Linuxaffected 6.12 ; unaffected 0 < 6.12 ; unaffected 6.12.96 ≤ 6.12.* ; unaffected 6.18.39 ≤ 6.18.* ; unaffected 7.1.4 ≤ 7.1.* ; unaffected 7.2 ≤ *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD