CVE-2026-72284 KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs Ignore KVM's internal "service pending PV EOI" request if the vCPU has disabled PV EOIs since the request was made. Asserting that PV EOIs are enabled can fai...

EUVD-2026-59183

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs Ignore KVM's internal "service pending PV EOI" request if the vCPU has disabled PV EOIs since the request was made. Asserting that PV EOIs are enabled can fai...

CVE-2026-72284

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs Ignore KVM's internal "service pending PV EOI" request if the vCPU has disabled PV EOIs since the request was made. Asserting that PV EOIs are enabled can fai...

CVE-2026-72284

CVE-2026-72284 affects the Linux kernel KVM on x86, where a logic error in arch/x86/kvm/lapic.c (line ~3338) caused PV EOIs to be ignored if the vCPU later disables PV EOIs, potentially triggering a kernel oops (invalid opcode) during KVM vCPU ioctls. The vulnerability is locally exploitable as p...

CVE-2026-72282

The CVE-2026-72282 entry concerns the Linux kernel KVM path: kvm_io_bus_get_dev() now requires the caller to hold the srcu lock, moving locking responsibilities to the caller. The function returns a device matched only by address, which can lead to a lifetime issue if the device’s type isn’t as e...

CVE-2026-72283 KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Nullify irqfd-producer if updating IRTE for bypass fails Nullify irqfd-producer if updating the IRTE for bypass fails, as leaving a dangling pointer will result in a use-after-free if the irqfd is reachable through KVM'...

CVE-2026-72283

CVE-2026-72283 concerns the Linux kernel's KVM/x86 path. The issue: when updating the IRTE for bypass fails, irqfd->producer is not cleared, creating a potential use-after-free if the irqfd is reachable via KVM routing while the producer is freed separately (e.g., VFIO PCI, where the producer ...

CVE-2026-72282 KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers

In the Linux kernel, the following vulnerability has been resolved: KVM: Move kvmiobusgetdev locking responsibilities to callers kvmiobusgetdev returns a device that is only matched by the address, and nothing else. This can cause a lifetime issue if the matched device is not the expected type, a...

CVE-2026-72282 KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers

In the Linux kernel, the following vulnerability has been resolved: KVM: Move kvmiobusgetdev locking responsibilities to callers kvmiobusgetdev returns a device that is only matched by the address, and nothing else. This can cause a lifetime issue if the matched device is not the expected type, a...

EUVD-2026-59181

In the Linux kernel, the following vulnerability has been resolved: KVM: Move kvmiobusgetdev locking responsibilities to callers kvmiobusgetdev returns a device that is only matched by the address, and nothing else. This can cause a lifetime issue if the matched device is not the expected type, a...

CVE-2026-72283

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Nullify irqfd-producer if updating IRTE for bypass fails Nullify irqfd-producer if updating the IRTE for bypass fails, as leaving a dangling pointer will result in a use-after-free if the irqfd is reachable through KVM'...

CVE-2026-72282

In the Linux kernel, the following vulnerability has been resolved: KVM: Move kvmiobusgetdev locking responsibilities to callers kvmiobusgetdev returns a device that is only matched by the address, and nothing else. This can cause a lifetime issue if the matched device is not the expected type, a...

CVE-2026-72283 KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Nullify irqfd-producer if updating IRTE for bypass fails Nullify irqfd-producer if updating the IRTE for bypass fails, as leaving a dangling pointer will result in a use-after-free if the irqfd is reachable through KVM'...

EUVD-2026-59182

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Nullify irqfd-producer if updating IRTE for bypass fails Nullify irqfd-producer if updating the IRTE for bypass fails, as leaving a dangling pointer will result in a use-after-free if the irqfd is reachable through KVM'...

CVE-2026-72281

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: account pKVM reclaim against the VM mm Protected guest faults charge long term pins to the VM's mm. Teardown can run later from file release, where current-mm may be unrelated. Drop the charge from kvm-mm instead...

CVE-2026-72281 KVM: arm64: account pKVM reclaim against the VM mm

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: account pKVM reclaim against the VM mm Protected guest faults charge long term pins to the VM's mm. Teardown can run later from file release, where current-mm may be unrelated. Drop the charge from kvm-mm instead...

EUVD-2026-59180

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: account pKVM reclaim against the VM mm Protected guest faults charge long term pins to the VM's mm. Teardown can run later from file release, where current-mm may be unrelated. Drop the charge from kvm-mm instead...

CVE-2026-72281

The CVE-2026-72281 entry concerns the Linux kernel KVM arm64/pKVM reclaim against the VM memory manager. The issue arose because protected guest faults could pin long-term resources to the VM’s mm (memory descriptor), and teardown could execute later from file release with current->mm potentia...

CVE-2026-72280

CVE-2026-72280 concerns the Linux kernel KVM on arm64. The vulnerability arises from a logic issue where a guest could write to the ZCR_EL2 sysreg alias in a nested context if FEAT_NV2 is advertised to the L1 hypervisor. The fix is to drop the bogus WARN that could lead to a hyp_panic once hyp ve...

CVE-2026-72279

The CVE-2026-72279 entry concerns the Linux kernel KVM arm64 implementation for the L1 VNCR mapping. The fix ensures that the host stage-1 mapping respects the read-only status of the guest PFN by caching PFN writability in the VNCR TLB and using this to constrain fixmap permissions. If a guest t...