CVE-2026-64604KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode When updating CR8 intercepts, get vmcs12 if and only if the vCPU is in guest mode so that a future change can have update CR8 intercepts during vCPU creation, without running afoul of get_vmcs12()'s lockdep assertion. ------------[ cut here ]------------ debug_locks && !(lock_is_held(&(&vcpu->mutex)->dep_map) || !refcount_read(&vcpu->kvm->users_count)) WARNING: arch/x86/kvm/vmx/nested.h:61 at get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline], CPU#0: syz.2.19/5879 WARNING: arch/x86/kvm/vmx/nested.h:61 at vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879, CPU#0: syz.2.19/5879 Modules linked in: CPU: 0 UID: 0 PID: 5879 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline] RIP: 0010:vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879 Call Trace: <TASK> apic_update_ppr arch/x86/kvm/lapic.c:984 [inline] kvm_lapic_reset+0x1c24/0x2980 arch/x86/kvm/lapic.c:3023 kvm_vcpu_reset+0x44c/0x1bf0 arch/x86/kvm/x86.c:12986 kvm_arch_vcpu_create+0x746/0x8b0 arch/x86/kvm/x86.c:12847 kvm_vm_ioctl_create_vcpu+0x428/0x930 virt/kvm/kvm_main.c:4201 kvm_vm_ioctl+0x893/0xd50 virt/kvm/kvm_main.c:5159 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> No functional change intended.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from a7c0b07d570848e50fce4d31ac01313484d6b844 before c7cd3605244c924249dea32632e1bc3e89bda543; from a7c0b07d570848e50fce4d31ac01313484d6b844 before 9a21f1defd96c6301c5fb462a78eb51b191bd2dd; from a7c0b07d570848e50fce4d31ac01313484d6b844 before 570af5db081b87374594a00711ac5760d2ea6844; from a7c0b07d570848e50fce4d31ac01313484d6b844 before ffaaff82336db84e9b58e7a3e81c2fd64e05ed7a; from a7c0b07d570848e50fce4d31ac01313484d6b844 before 258ec63c0f281bf7b50f9de67c8e93b5b7be5ed4; from a7c0b07d570848e50fce4d31ac01313484d6b844 before 3dcfb04dd43b16fa1240fc6487fff578ad57264c; from a7c0b07d570848e50fce4d31ac01313484d6b844 before db8407b9fd06d857a4a5e8bcff1d086d13007711; from a7c0b07d570848e50fce4d31ac01313484d6b844 before 7ef78d71ca713d8c00f7c34ddcf276c808143f77 | CNA record |
References
- https://git.kernel.org/stable/c/c7cd3605244c924249dea32632e1bc3e89bda543
- https://git.kernel.org/stable/c/9a21f1defd96c6301c5fb462a78eb51b191bd2dd
- https://git.kernel.org/stable/c/570af5db081b87374594a00711ac5760d2ea6844
- https://git.kernel.org/stable/c/ffaaff82336db84e9b58e7a3e81c2fd64e05ed7a
- https://git.kernel.org/stable/c/258ec63c0f281bf7b50f9de67c8e93b5b7be5ed4
- https://git.kernel.org/stable/c/3dcfb04dd43b16fa1240fc6487fff578ad57264c
- https://git.kernel.org/stable/c/db8407b9fd06d857a4a5e8bcff1d086d13007711
- https://git.kernel.org/stable/c/7ef78d71ca713d8c00f7c34ddcf276c808143f77
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.