Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: KVM: SVM: Obtain source vCPUs from the source VM for SEV-ES intrahost migration Fixed a bug where KVM attempts to retrieve source vCPUs from the destination VM during intrahost migration. Retrieving the wrong vCPU not only hal...

CVE-2026-31591 KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish Lock all vCPUs when synchronizing and encrypting VMSAs for SNP guests, as allowing userspace to manipulate and/or run a vCPU while its state is being...

CVE-2026-31591

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish Lock all vCPUs when synchronizing and encrypting VMSAs for SNP guests, as allowing userspace to manipulate and/or run a vCPU while its state is being...

CVE-2026-31591

The CVE-2026-31591 entry details a Linux kernel KVM SNP/VMSA issue where vCPU state synchronization and encryption during SNP launch could be interfered with by userspace, risking vCPU state corruption or host kernel crashes. The root cause is insufficient locking around vcpu->mutex during VMS...

PT-2026-34943

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM SEV component where vCPUs are not locked during the synchronization and encryption of VMSAs for SNP guests. If userspace manipulates or runs a vCPU while its...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the KVM SEV not locking all vCPUs when SNP completes synchronization and encryption of VMSA. This...

CVE-2025-58148

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause...

KVM: arm64: Disassociate vcpus from redistributor region on teardown

...

CVE-2025-38366 LoongArch: KVM: Check validity of "num_cpu" from user space

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Check validity of "numcpu" from user space The maximum supported cpu number is EIOINTCROUTEMAXVCPUS about irqchip EIOINTC, here add validation about cpu number to avoid array pointer overflow...

kernel: KVM: arm64: Disassociate vcpus from redistributor region on teardown

A vulnerability was found in the Linux kernel's KVM for ARM64 within the vgic-init.c, vgic-mmio-v3.c, and vgic.h files. The virtual vCPUs may retain dangling pointers in a redistributor region after they have been torn down, leading to potential memory corruption...

kernel: KVM: arm64: Disassociate vcpus from redistributor region on teardown

A vulnerability was found in the Linux kernel's KVM for ARM64 within the vgic-init.c, vgic-mmio-v3.c, and vgic.h files. The virtual vCPUs may retain dangling pointers in a redistributor region after they have been torn down, leading to potential memory corruption...

SUSE CVE-2024-26768

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Change acpicorepicNRCPUS to acpicorepicMAXCOREPIC With default config, the value of NRCPUS is 64. When HW platform has more then 64 cpus, system will crash on these platforms. MAXCOREPIC is the maximum cpu number in MA...

SUSE CVE-2021-47062

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Use onlinevcpus, not createdvcpus, to iterate over vCPUs Use the kvmforeachvcpu helper to iterate over vCPUs when encrypting VMSAs for SEV, which effectively switches to use onlinevcpus instead of createdvcpus. This fix...

UBUNTU-CVE-2021-47062

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Use onlinevcpus, not createdvcpus, to iterate over vCPUs Use the kvmforeachvcpu helper to iterate over vCPUs when encrypting VMSAs for SEV, which effectively switches to use onlinevcpus instead of createdvcpus. This fix...

Xen Security Vulnerabilities

Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A security vulnerability exists in Xen that...

PT-2021-8001 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a possible null-pointer dereference in the KVM subsystem of the Linux kernel. This occurs when using the created vcpus parameter instead of online vcpus to...

DEBIAN-CVE-2020-25604

An issue was discovered in Xen through 4.14.x. There is a race condition when migrating timers between x86 HVM vCPUs. When migrating timers of x86 HVM guests between its vCPUs, the locking model used allows for a second vCPU of the same guest also operating on the timers to release a lock that it...

How to pin Citrix Hypervisor Virtual CPUs to specific Physical CPUs

Citrix Hypervisor maps vCPUs to pCPUs by default in a semi-even way to distribute VM load on the host. In some cases it may be needed to have a specific mapping, for example, if some VMs will be CPU intensive while other wont, the intensive VMs can be mapped to exclusive physical CPUs while the...

Overcommitting pCPUs on individual XenServer VMs

Citrix recommends that you do not run a VM with more virtual CPUs vCPUs than the number physical CPUs pCPUs available on the XenServer host. The number of pCPUs available to XenServer can change even after the installation of VMs. For example, through actual hardware changes, changes in the BIOS...

DEBIAN-CVE-2018-12891

An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may take a long time to process. For that reason Xen explicitly checks for the need to preempt the current vCPU at certain points. A few rarely taken code paths did bypass such checks. By suitably enforcing the conditions...