kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active

A flaw was found in KVM Kernel-based Virtual Machine. When the Advanced Virtual Interrupt Controller AVIC is inhibited while a nested guest L2 is active, KVM fails to properly update x2APIC MSR intercepts for the primary guest L1. This allows the L1 guest to read the host's APIC state, send...

Linux Distros Unpatched Vulnerability : CVE-2026-89513

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENTGETINFO stores guest-controlled numevents sizeofeinfo in a 32-bit integer. On RV64, numevents =...

CVE-2026-89513

CVE-2026-89513 is an integer overflow in the Linux kernel's KVM (RISC-V) component. The SBI PMU EVENT_GET_INFO handler stores num_events * sizeof(*einfo) in a 32-bit integer; on RV64, a guest-supplied num_events = 0x10000001 truncates the allocation to 16 bytes while KVM still loops over the orig...

EUVD-2026-76419

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENTGETINFO stores guest-controlled numevents sizeofeinfo in a 32-bit integer. On RV64, numevents = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one...

CVE-2026-89513 RISC-V: KVM: Fix PMU event info array size overflow

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENTGETINFO stores guest-controlled numevents sizeofeinfo in a 32-bit integer. On RV64, numevents = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one...

CVE-2026-89513

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENTGETINFO stores guest-controlled numevents sizeofeinfo in a 32-bit integer. On RV64, numevents = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one...

CVE-2026-80921

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb crycb 0 or 1, the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested...

DEBIAN-CVE-2026-80921

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb crycb 0 or 1, the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested...

AZL-99950 CVE-2026-80921 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb crycb 0 or 1, the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested...

CVE-2026-80921

CVE-2026-80921 affects the Linux kernel in the KVM s390 vsie (Virtual SIE) subsystem. When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), bits 64–255 retain stale values from the vsie page, potentially allowing a nested guest to access a device no longer available . The CVSS 3.1...

EUVD-2026-75098

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb crycb 0 or 1, the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested...

CVE-2026-80921 KVM: s390: vsie: zero stale crypto bits

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb crycb 0 or 1, the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested...

CVE-2026-80921 KVM: s390: vsie: zero stale crypto bits

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb crycb 0 or 1, the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested...

PT-2026-89091

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM s390 vsie component where crypto access bits are shadowed from a format0 apcb crycb 0 or 1. Specifically, bits 64 through 255 remain unchanged from the values ...

Linux Distros Unpatched Vulnerability : CVE-2026-80921

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb crycb 0 or 1, the bits 64..255 are unchanged from whatever is in t...

CVE-2026-80921: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb crycb 0 or 1, the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested...

kernel: KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks

A flaw was found in the KVM's Intel nested virtualization feature nVMX. Since L1 and L2 shared branch prediction modes guest-user and guest-kernel, KVM did not protect indirect branches in L1 from steering by a malicious agent in L2. This could allow a malicious nested guest to carry out Spectre ...

LSN-0081-1: Kernel Live Patch Security Notice

Maxim Levitsky discovered that the KVM hypervisor implementation for AMD processors in the Linux kernel did not properly prevent a guest VM from enabling AVIC in nested guest VMs. An attacker in a guest VM could use this to write to portions of the host's physical memory.CVE-2021-3653 Maxim...

USN-5072-1: Linux kernel vulnerabilities

Maxim Levitsky and Paolo Bonzini discovered that the KVM hypervisor implementation for AMD processors in the Linux kernel allowed a guest VM to disable restrictions on VMLOAD/VMSAVE in a nested guest. An attacker in a guest VM could use this to read or write portions of the host's physical memory...

USN-4300-1: Linux kernel vulnerabilities

It was discovered that the KVM implementation in the Linux kernel, when paravirtual TLB flushes are enabled in guests, the hypervisor in some situations could miss deferred TLB flushes or otherwise mishandle them. An attacker in a guest VM could use this to expose sensitive information read memor...