UBUNTU-CVE-2026-64287

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound usedlrs when flushing the pKVM hyp vCPU flushhypvcpu copies the host vGIC state into the hyp's private vCPU on every run. The vGIC list register save and restore use usedlrs as their loop bound and expect it to...

UBUNTU-CVE-2026-64513

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Unconditionally recompute CR8 intercept on PPR update The TPRTHRESHOLD field in the VMCS is used by VMX to induce VM exits when the guest's virtual TPR falls under the specified threshold, allowing KVM to inject...

UBUNTU-CVE-2026-64307

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctlSNPCONFIG Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and ze...

UBUNTU-CVE-2026-64310

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for SEV ioctls Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and zero o...

UBUNTU-CVE-2026-64285

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Pin source page for write when adding CPUID data for SNP guest When populating a guestmemfd instance with the initial CPUID data for an SNP guest, acquire a writable pin on the source page as KVM will write back the...

UBUNTU-CVE-2026-64283

In the Linux kernel, the following vulnerability has been resolved: KVM: guestmemfd: Treat memslot binding offset+size as unsigned values When binding a memslot to a guestmemfd file, treat the offset and size as unsigned values to fix a bug where the sum of the two can result in a false negative...

UBUNTU-CVE-2026-64286

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Clear hyprunningvcpu when flushing the pKVM hyp vCPU flushhypvcpu copies the host vCPU context into the hyp's private vCPU on every run. ctxttovcpu expects a guest context to have a NULL hyprunningvcpu, which is only...

UBUNTU-CVE-2026-64284

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Move the handling of fastpath userspace exits into vendor code to ensure KVM runs vendor specific operations that need to run before userspace gains...

EUVD-2026-48857

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Unconditionally recompute CR8 intercept on PPR update The TPRTHRESHOLD field in the VMCS is used by VMX to induce VM exits when the guest's virtual TPR falls under the specified threshold, allowing KVM to inject...

CVE-2026-64513

CVE-2026-64513 affects the Linux kernel KVM x86 path, where CR8 intercept is recomputed on PPR update. Root cause: after a patch to speed up TPR below-threshold vmexits, apic_update_ppr() can omit a deliverable interrupt, causing kvm_lapic_update_cr8_intercept() and vmx_update_cr8_intercept() to ...

CVE-2026-64513 KVM: x86: Unconditionally recompute CR8 intercept on PPR update

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Unconditionally recompute CR8 intercept on PPR update The TPRTHRESHOLD field in the VMCS is used by VMX to induce VM exits when the guest's virtual TPR falls under the specified threshold, allowing KVM to inject...

CVE-2026-64513 KVM: x86: Unconditionally recompute CR8 intercept on PPR update

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Unconditionally recompute CR8 intercept on PPR update The TPRTHRESHOLD field in the VMCS is used by VMX to induce VM exits when the guest's virtual TPR falls under the specified threshold, allowing KVM to inject...

CVE-2026-64513

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Unconditionally recompute CR8 intercept on PPR update The TPRTHRESHOLD field in the VMCS is used by VMX to induce VM exits when the guest's virtual TPR falls under the specified threshold, allowing KVM to inject...

CVE-2026-64460

In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Skip VF Resizable BAR restore on read error sriovrestorevfrebarstate uses the VF Resizable BAR Control register to decide how many VF BARs to restore nbars and which VF BAR each iteration addresses baridx. baridx indexes...

CVE-2026-64310 crypto: ccp - Do not initialize SNP for SEV ioctls

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for SEV ioctls Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and zero o...

CVE-2026-64310

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for SEV ioctls Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and zero o...

EUVD-2026-49022

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for SEV ioctls Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and zero o...

CVE-2026-64308

The CVE-2026-64308 issue in the Linux kernel concerns the crypto CCP SNP_VLEK_LOAD path. The fix removes SNP initialization for ioctl(SNP_VLEK_LOAD), addressing a scenario where SEV initialization failures could allow a userspace trigger to affect MSR_VM_HSAVE_PA and potentially impact a running ...

EUVD-2026-49019

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctlSNPCONFIG Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and ze...

CVE-2026-64287 KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound usedlrs when flushing the pKVM hyp vCPU flushhypvcpu copies the host vGIC state into the hyp's private vCPU on every run. The vGIC list register save and restore use usedlrs as their loop bound and expect it to...