AZL-101610 CVE-2026-89932 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Always flush vpid02 on first use Make sure vpid02 is always flushed on first use by setting lastvpid=0 when allocating vpid02. nestedvmxtransitiontlbflush will always detect a VPID change on first VM-Enter after VMXON,...

AZL-101277 CVE-2026-89929 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU When emulating INVVPID, KVM executes INVVPID on the physical CPU using vpid02 instead of the L1 assigned VPID, after doing some validations on the operands. However...

CVE-2026-89932

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Always flush vpid02 on first use Make sure vpid02 is always flushed on first use by setting lastvpid=0 when allocating vpid02. nestedvmxtransitiontlbflush will always detect a VPID change on first VM-Enter after VMXON,...

DEBIAN-CVE-2026-89930

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Service local TLB flushes on failed nested VM-Enter KVM services local TLB flushes on "full" nested VM-Exits through nestedvmxvmexit, but not if a nested VM-Enter fails e.g. due to failed VMCS checks in...

CVE-2026-89928

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk kvmrmaplock deliberately elides the rmap lock when it observes an empty rmap. In that case kvmrmaplockreadonly also re-enables preemption and returns zero, so...

CVE-2026-89929

In the Linux kernel, the following vulnerability has been resolved: KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU When emulating INVVPID, KVM executes INVVPID on the physical CPU using vpid02 instead of the L1 assigned VPID, after doing some validations on the operands. However...

CVE-2026-89931

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Ensure KVMREQGETNESTEDSTATEPAGES is cleared on VM-Exit Always check and clear KVMREQGETNESTEDSTATEPAGES when emulating a nested VM-Exit to ensure the request is cleared, even when KVM was built with CONFIGKVMHYPERV=n, ...

AZL-101532 CVE-2026-89930 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Service local TLB flushes on failed nested VM-Enter KVM services local TLB flushes on "full" nested VM-Exits through nestedvmxvmexit, but not if a nested VM-Enter fails e.g. due to failed VMCS checks in...

DEBIAN-CVE-2026-89931

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Ensure KVMREQGETNESTEDSTATEPAGES is cleared on VM-Exit Always check and clear KVMREQGETNESTEDSTATEPAGES when emulating a nested VM-Exit to ensure the request is cleared, even when KVM was built with CONFIGKVMHYPERV=n, ...

DEBIAN-CVE-2026-89932

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Always flush vpid02 on first use Make sure vpid02 is always flushed on first use by setting lastvpid=0 when allocating vpid02. nestedvmxtransitiontlbflush will always detect a VPID change on first VM-Enter after VMXON,...

AZL-101468 CVE-2026-89922 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Take srcu when importing watchpoint data importwpinfo backs up the original guest memory contents of a watchpoint with readguestabs, which is kvmreadguest and therefore resolves the memslot via kvmmemslots. That requir...

AZL-101535 CVE-2026-89921 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Zero initialize data structures for injectpfaulttoken kvminjectpfaulttoken only sets .type and .u.ext.extparams2 of the on-stack struct kvms390irq but the full ext substructure is copied into the cpu local variable on...

DEBIAN-CVE-2026-89925

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix memory leak in guest debug handling bpdata is freed only for the error case by kfreebpdata. Every successful KVMSETGUESTDEBUG will leak bpdata...

DEBIAN-CVE-2026-89926

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix length check importwpinfo struct kvmhwbreakpoint::len is a u64 that is fully controlled by user space. This is then assigned to wpinfo-len, which is an int. The bounds check is done on the truncated value while the...

AZL-101664 CVE-2026-89920 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix memory corruption by not reinjecting CK machine checks Channel-subsystem damage machine checks are for the host channel subsystem. The guest channel subsystem is emulated in the userspace VMM. There is no point in...

DEBIAN-CVE-2026-89922

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Take srcu when importing watchpoint data importwpinfo backs up the original guest memory contents of a watchpoint with readguestabs, which is kvmreadguest and therefore resolves the memslot via kvmmemslots. That requir...

CVE-2026-89923

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Free guest debug data on vcpu destroy kvms390clearbpdata is only called from kvmarchvcpuioctlsetguestdebug, i.e. when user space changes or disables debugging. A vCPU that is destroyed while hardware breakpoints are...

DEBIAN-CVE-2026-89920

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix memory corruption by not reinjecting CK machine checks Channel-subsystem damage machine checks are for the host channel subsystem. The guest channel subsystem is emulated in the userspace VMM. There is no point in...

CVE-2026-89924

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix olddata leak in guest debug error path importwpinfo allocates a per-watchpoint olddata buffer to back up the original guest memory contents. If a later watchpoint of the same KVMSETGUESTDEBUG request fails to impor...

CVE-2026-89927

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock Fix an issue where userspace or the guest can program an Hyper-V synthetic timer to have a deadline in the past via integer overflow, preventing the CPU from making...