CVE-2026-43214 - Vulnerability Details

- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()

Add SRCU read-side protection when reading PDPTR registers in
__get_sregs2().

Reading PDPTRs may trigger access to guest memory:
kvm_pdptr_read() -> svm_cache_reg() -> load_pdptrs() ->
kvm_vcpu_read_guest_page() -> kvm_vcpu_gfn_to_memslot()

kvm_vcpu_gfn_to_memslot() dereferences memslots via __kvm_memslots(),
which uses srcu_dereference_check() and requires either kvm->srcu or
kvm->slots_lock to be held. Currently only vcpu->mutex is held,
triggering lockdep warning:

=============================
WARNING: suspicious RCU usage in kvm_vcpu_gfn_to_memslot
6.12.59+ #3 Not tainted

include/linux/kvm_host.h:1062 suspicious rcu_dereference_check() usage!

other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1
1 lock held by syz.5.1717/15100:
#0: ff1100002f4b00b0 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x1d5/0x1590

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0xf0/0x120 lib/dump_stack.c:120
lockdep_rcu_suspicious+0x1e3/0x270 kernel/locking/lockdep.c:6824
__kvm_memslots include/linux/kvm_host.h:1062 [inline]
__kvm_memslots include/linux/kvm_host.h:1059 [inline]
kvm_vcpu_memslots include/linux/kvm_host.h:1076 [inline]
kvm_vcpu_gfn_to_memslot+0x518/0x5e0 virt/kvm/kvm_main.c:2617
kvm_vcpu_read_guest_page+0x27/0x50 virt/kvm/kvm_main.c:3302
load_pdptrs+0xff/0x4b0 arch/x86/kvm/x86.c:1065
svm_cache_reg+0x1c9/0x230 arch/x86/kvm/svm/svm.c:1688
kvm_pdptr_read arch/x86/kvm/kvm_cache_regs.h:141 [inline]
__get_sregs2 arch/x86/kvm/x86.c:11784 [inline]
kvm_arch_vcpu_ioctl+0x3e20/0x4aa0 arch/x86/kvm/x86.c:6279
kvm_vcpu_ioctl+0x856/0x1590 virt/kvm/kvm_main.c:4663
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xbd/0x1d0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Published: 2026-05-06

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel KVM hypervisor for x86 has a concurrency bug in the __get_sregs2() function: reading the PDPTR registers is performed without the required SRCU protection, which can trigger access to guest memory while the memslots are not properly locked. This unsynchronized access falls under CWE‑362 that can lead to memory corruption or a crash in the host kernel if an attacker exploits the race condition. The kernel emits a lockdep warning about suspicious RCU usage, indicating that the code path is operating outside the expected synchronization guarantees.

Affected Systems

All Linux kernels that include the KVM hypervisor for x86 but do not contain the SRCU guard in __get_sregs2() are affected. The vendor list specifies Linux:Linux, indicating that any distribution shipping an unpatched Linux kernel build is susceptible until the patch is applied. No specific distribution or version numbers are provided, so operators should check whether their kernel revision predates the change that added SRCU protection.

Risk and Exploitability

The CVSS score of 7.8 denotes a high severity vulnerability, while the EPSS score of less than 1% suggests a low probability of real‑world exploitation. The vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector involves the KVM ioctl interface, either from a privileged host process or a guest that can influence the host via a crafted ioctl call. In the event of exploitation, an attacker could cause a kernel memory corruption or a denial‑of‑service, compromising the host’s integrity and availability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`6dba940352038b56db9b591b172fb2ec76a5fd5e`	affected	< f621ca24f9f489e226e22560761b04884984133b
`6dba940352038b56db9b591b172fb2ec76a5fd5e`	affected	< 708e20c66b2761d878a2bc3c7534e7f814e4dec5
`6dba940352038b56db9b591b172fb2ec76a5fd5e`	affected	< 9f2bfea51151dfbb24b52f452eb3d5f5fe0e506e
`6dba940352038b56db9b591b172fb2ec76a5fd5e`	affected	< 57536ff0a6bd69a5808d682925202babdb5ddc13
`6dba940352038b56db9b591b172fb2ec76a5fd5e`	affected	< b33f8d816950b10e7879cd8ffd7ae4b649ada4db
`6dba940352038b56db9b591b172fb2ec76a5fd5e`	affected	< 95d848dc7e639988dbb385a8cba9b484607cf98c

Linux

affected

Version	Status	Constraints
`5.14`	affected	—
`0`	unaffected	< 5.14
`6.1.165`	unaffected	≤ 6.1.*
`6.6.128`	unaffected	≤ 6.6.*
`6.12.75`	unaffected	≤ 6.12.*
`6.18.16`	unaffected	≤ 6.18.*
`6.19.6`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6dba940352038b56db9b591b172fb2ec76a5fd5e, f621ca24f9f489e226e22560761b04884984133b)`	affected	code_commit	—
`[6dba940352038b56db9b591b172fb2ec76a5fd5e, 708e20c66b2761d878a2bc3c7534e7f814e4dec5)`	affected	code_commit	—
`[6dba940352038b56db9b591b172fb2ec76a5fd5e, 9f2bfea51151dfbb24b52f452eb3d5f5fe0e506e)`	affected	code_commit	—
`[6dba940352038b56db9b591b172fb2ec76a5fd5e, 57536ff0a6bd69a5808d682925202babdb5ddc13)`	affected	code_commit	—
`[6dba940352038b56db9b591b172fb2ec76a5fd5e, b33f8d816950b10e7879cd8ffd7ae4b649ada4db)`	affected	code_commit	—
`[6dba940352038b56db9b591b172fb2ec76a5fd5e, 95d848dc7e639988dbb385a8cba9b484607cf98c)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.14`	affected	generic	—
`[0,5.14)`	unaffected	generic	—
`[6.1.165,6.2.0)`	unaffected	semver	—
`[6.6.128,6.7.0)`	unaffected	semver	—
`[6.12.75,6.13.0)`	unaffected	semver	—
`[6.18.16,6.19.0)`	unaffected	semver	—
`[6.19.6,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the upstream kernel update that introduces SRCU protection in __get_sregs2() to eliminate the race condition (CWE‑362).
If the kernel cannot be updated immediately, limit KVM access to trusted users and run virtual machines in a hardened, sandboxed environment to reduce the attack surface for the unsynchronized read.
Enable lockdep and routinely inspect kernel logs for warnings about suspicious RCU usage in kvm_vcpu_gfn_to_memslot; any such warning should prompt an investigation and patch deployment.

Generated by OpenCVE AI on October 23, 2026 at 01:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8492-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8492-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8497-1	Linux kernel (Low Latency) vulnerabilities
Ubuntu USN	USN-8498-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8499-1	Linux kernel (Xilinx) vulnerabilities
Ubuntu USN	USN-8492-3	Linux kernel (Raspberry Pi Real-time) vulnerabilities
Ubuntu USN	USN-8492-4	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8492-5	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00107.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/57536ff0a6bd69a5808d682925202babdb5ddc13
https://git.kernel.org/stable/c/708e20c66b2761d878a2bc3c7534e7f814e4dec5
https://git.kernel.org/stable/c/95d848dc7e639988dbb385a8cba9b484607cf98c
https://git.kernel.org/stable/c/9f2bfea51151dfbb24b52f452eb3d5f5fe0e506e
https://git.kernel.org/stable/c/b33f8d816950b10e7879cd8ffd7ae4b649ada4db
https://git.kernel.org/stable/c/f621ca24f9f489e226e22560761b04884984133b
https://lore.kernel.org/linux-cve-announce/2026050650-CVE-2026-43214-37cb@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-43214
https://www.cve.org/CVERecord?id=CVE-2026-43214

History

Mon, 19 Oct 2026 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362

Fri, 16 Oct 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 11 May 2026 19:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo

Fri, 08 May 2026 13:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 07 May 2026 04:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362

Thu, 07 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-820
References		https://lore.kernel.org/linux-cve-announce/2026050650-CVE-2026-43214-37cb@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-43214 https://www.cve.org/CVERecord?id=CVE-2026-43214
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Wed, 06 May 2026 16:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362

Wed, 06 May 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() Add SRCU read-side protection when reading PDPTR registers in __get_sregs2(). Reading PDPTRs may trigger access to guest memory: kvm_pdptr_read() -> svm_cache_reg() -> load_pdptrs() -> kvm_vcpu_read_guest_page() -> kvm_vcpu_gfn_to_memslot() kvm_vcpu_gfn_to_memslot() dereferences memslots via __kvm_memslots(), which uses srcu_dereference_check() and requires either kvm->srcu or kvm->slots_lock to be held. Currently only vcpu->mutex is held, triggering lockdep warning: ============================= WARNING: suspicious RCU usage in kvm_vcpu_gfn_to_memslot 6.12.59+ #3 Not tainted include/linux/kvm_host.h:1062 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by syz.5.1717/15100: #0: ff1100002f4b00b0 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x1d5/0x1590 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xf0/0x120 lib/dump_stack.c:120 lockdep_rcu_suspicious+0x1e3/0x270 kernel/locking/lockdep.c:6824 __kvm_memslots include/linux/kvm_host.h:1062 [inline] __kvm_memslots include/linux/kvm_host.h:1059 [inline] kvm_vcpu_memslots include/linux/kvm_host.h:1076 [inline] kvm_vcpu_gfn_to_memslot+0x518/0x5e0 virt/kvm/kvm_main.c:2617 kvm_vcpu_read_guest_page+0x27/0x50 virt/kvm/kvm_main.c:3302 load_pdptrs+0xff/0x4b0 arch/x86/kvm/x86.c:1065 svm_cache_reg+0x1c9/0x230 arch/x86/kvm/svm/svm.c:1688 kvm_pdptr_read arch/x86/kvm/kvm_cache_regs.h:141 [inline] __get_sregs2 arch/x86/kvm/x86.c:11784 [inline] kvm_arch_vcpu_ioctl+0x3e20/0x4aa0 arch/x86/kvm/x86.c:6279 kvm_vcpu_ioctl+0x856/0x1590 virt/kvm/kvm_main.c:4663 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xbd/0x1d0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Title		KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/57536ff0a6bd69a5808d682925202babdb5ddc13 https://git.kernel.org/stable/c/708e20c66b2761d878a2bc3c7534e7f814e4dec5 https://git.kernel.org/stable/c/95d848dc7e639988dbb385a8cba9b484607cf98c https://git.kernel.org/stable/c/9f2bfea51151dfbb24b52f452eb3d5f5fe0e506e https://git.kernel.org/stable/c/b33f8d816950b10e7879cd8ffd7ae4b649ada4db https://git.kernel.org/stable/c/f621ca24f9f489e226e22560761b04884984133b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-06T11:28:16.766Z

Updated: 2026-10-19T19:16:24.580Z

Reserved: 2026-05-01T14:12:55.993Z

Link: CVE-2026-43214

Vulnrichment

Updated: 2026-10-16T15:15:51.647Z

NVD

Status : Modified

Published: 2026-05-06T12:16:40.920

Modified: 2026-10-19T20:18:11.430

Link: CVE-2026-43214

Redhat

Severity : Moderate

Publid Date: 2026-05-06T00:00:00Z

Links: CVE-2026-43214 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-23T01:45:14Z

Weaknesses

CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-820
Missing Synchronization
NVD-CWE-noinfo

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object