CVE-2023-54296 KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration Fix a goof where KVM tries to grab source vCPUs from the destination VM when doing intrahost migration. Grabbing the wrong vCPU not only hoses the guest, it...

PT-2025-54070

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.4.0-rc3+ 1671 Description The Linux kernel contains a flaw related to KVM on MIPS architecture. Specifically, a NULL pointer dereference can occur when creating a KVM guest after a commit removed KVM TE support...

CVE-2023-54092

In Astra Linux and SUSE OSV notes, CVE-2023-54092 corresponds to a Linux kernel KVM s390 issue where the ASCE replacement could carry a non-zero index, causing incorrect addresses to be passed during PTE invalidations and potentially triggering VM crashes when a prefix is unmapped. The documented...

CVE-2023-54024 KVM: Destroy target device if coalesced MMIO unregistration fails

In the Linux kernel, the following vulnerability has been resolved: KVM: Destroy target device if coalesced MMIO unregistration fails Destroy and free the target coalesced MMIO device if unregistering said device fails. As clearly noted in the code, kvmiobusunregisterdev does not destroy the targ...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the failure to destroy the target device when the KVM merge MMIO device logout fails, potentially leading to...

SUSE CVE-2025-68259

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced When re-injecting a soft interrupt from an INT3, INT0, or select INTn instruction, discard the exception and retry the instruction if the code stream is changed...

CVE-2025-68259

Summary: In the Linux kernel’s KVM/SVM path, re-injecting a soft interrupt when replacing INT3/INT0/INTn can lead to decoding a different instruction and thus a wrong next RIP. This can clobber guest state and trigger a guest panic (e.g., Oops: int3) if the RIP lookup uses the incorrect instructi...

SUSE CVE-2023-53756

In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Fix crash due to uninitialized currentvmcs KVM enables 'Enlightened VMCS' and 'Enlightened MSR Bitmap' when running as a nested hypervisor on top of Hyper-V. When MSR bitmap is updated, evmcstouchmsrbitmap function uses...

CVE-2023-53756 KVM: VMX: Fix crash due to uninitialized current_vmcs

In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Fix crash due to uninitialized currentvmcs KVM enables 'Enlightened VMCS' and 'Enlightened MSR Bitmap' when running as a nested hypervisor on top of Hyper-V. When MSR bitmap is updated, evmcstouchmsrbitmap function uses...

CVE-2025-40274

CVE-2025-40274 (Linux kernel KVM guest_memfd) : The issue arises when unbinding a memslot from a guest_memfd instance if the guest_memfd is dying (file refcount zero). Bindings are not protected against this lifecycle, so a memslot freed before the file is fully released can cause a write to free...

The vulnerability of the Linux operating system’s kernel virtualization mechanism, which allows a hacker to trigger a service failure

The vulnerability of the Linux operating system’s kernel virtualization mechanism relates to the copying of buffers without checking the input data. Exploiting this vulnerability allows an attacker to trigger a service failure...

CVE-2025-40266

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Check the untrusted offset in FF-A memory share Verify the offset to prevent OOB access in the hypervisor FF-A buffer in case an untrusted large enough value U32MAX - sizeofstruct ffacompositememregion + 1, U32MAX is...

CVE-2025-40266

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Check the untrusted offset in FF-A memory share Verify the offset to prevent OOB access in the hypervisor FF-A buffer in case an untrusted large enough value U32MAX - sizeofstruct ffacompositememregion + 1, U32MAX is...

USN-7907-3 linux-gcp, linux-gcp-4.15, linux-hwe vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Cryptographic API; - ACPI drivers; - Hardware monitoring drivers; - InfiniBand drivers; - Mailbox framework; -...

The vulnerability of the kvm_arch_vcpu_ioctl_set_fpu() function in the arch/s390/kvm/kvm-s390.c module of the S390 platform support for the Linux operating system allows a attacker to compromise the integrity and accessibility of protected information.

The vulnerability of the kvmarchvcpuioctlsetfpu function in the arch/s390/kvm/kvm-s390.c module of the S390 platform support for the Linux operating system is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to compromise the integrity and...

KVM: x86/mmu: Treat NX as a valid SPTE bit for NPT

...

kernel: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush In KVM guests with Hyper-V hypercalls enabled, the hypercalls HVCALLFLUSHVIRTUALADDRESSLIST and HVCALLFLUSHVIRTUALADDRESSLISTEX allow a guest to request...

CVE-2025-40184 KVM: arm64: Fix debug checking for np-guests using huge mappings

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix debug checking for np-guests using huge mappings When running with transparent huge pages and CONFIGNVHEEL2DEBUG then the debug checking in asserthostsharedguest fails on the launch of an np-guest. This WARNON...

CVE-2025-40181 x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP When running as an SNP or TDX guest under KVM, force the legacy PCI hole, i.e. memory between Top of Lower Usable DRAM and 4GiB, to be mapped as UC via a forc...

kernel: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()

In the Linux kernel, the following vulnerability has been resolved: KVM: Explicitly verify target vCPU is online in kvmgetvcpu Explicitly verify the target vCPU is fully online prior to clamping the index in kvmgetvcpu. If the index is "bad", the nospec clamping will generate '0', i.e. KVM will...