CVE-2026-43214 - Vulnerability Details

- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()

Add SRCU read-side protection when reading PDPTR registers in
__get_sregs2().

Reading PDPTRs may trigger access to guest memory:
kvm_pdptr_read() -> svm_cache_reg() -> load_pdptrs() ->
kvm_vcpu_read_guest_page() -> kvm_vcpu_gfn_to_memslot()

kvm_vcpu_gfn_to_memslot() dereferences memslots via __kvm_memslots(),
which uses srcu_dereference_check() and requires either kvm->srcu or
kvm->slots_lock to be held. Currently only vcpu->mutex is held,
triggering lockdep warning:

=============================
WARNING: suspicious RCU usage in kvm_vcpu_gfn_to_memslot
6.12.59+ #3 Not tainted

include/linux/kvm_host.h:1062 suspicious rcu_dereference_check() usage!

other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1
1 lock held by syz.5.1717/15100:
#0: ff1100002f4b00b0 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x1d5/0x1590

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0xf0/0x120 lib/dump_stack.c:120
lockdep_rcu_suspicious+0x1e3/0x270 kernel/locking/lockdep.c:6824
__kvm_memslots include/linux/kvm_host.h:1062 [inline]
__kvm_memslots include/linux/kvm_host.h:1059 [inline]
kvm_vcpu_memslots include/linux/kvm_host.h:1076 [inline]
kvm_vcpu_gfn_to_memslot+0x518/0x5e0 virt/kvm/kvm_main.c:2617
kvm_vcpu_read_guest_page+0x27/0x50 virt/kvm/kvm_main.c:3302
load_pdptrs+0xff/0x4b0 arch/x86/kvm/x86.c:1065
svm_cache_reg+0x1c9/0x230 arch/x86/kvm/svm/svm.c:1688
kvm_pdptr_read arch/x86/kvm/kvm_cache_regs.h:141 [inline]
__get_sregs2 arch/x86/kvm/x86.c:11784 [inline]
kvm_arch_vcpu_ioctl+0x3e20/0x4aa0 arch/x86/kvm/x86.c:6279
kvm_vcpu_ioctl+0x856/0x1590 virt/kvm/kvm_main.c:4663
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xbd/0x1d0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Published: 2026-05-06

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel KVM hypervisor contains a bug in the __get_sregs2() function, where reading the PDPTR registers occurs without SRCU protection. This represents a classic concurrency issue, categorized as CWE‑362, where proper synchronization between threads is lacking. The race can allow the kernel to dereference guest memory while only the vcpu mutex is held, bypassing the SRCU checks required by __kvm_memslots() and potentially corrupting kernel data structures or triggering a system crash.

Affected Systems

All x86 Linux kernel releases that include the KVM hypervisor but do not contain the SRCU guard in __get_sregs2(). No distribution or kernel version is specified, so any kernel built before the patch is considered vulnerable.

Risk and Exploitability

No public CVSS or EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to use the KVM ioctl interface from within a guest or from a privileged host process, meaning it is a local attack surface. While the attack vector is narrow and would need crafted input, the potential to corrupt kernel memory or cause a crash could lead to denial of service or a loss of integrity for the host. Operators should regard the patch as essential to mitigate this risk.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`6dba940352038b56db9b591b172fb2ec76a5fd5e`	affected	< f621ca24f9f489e226e22560761b04884984133b
`6dba940352038b56db9b591b172fb2ec76a5fd5e`	affected	< 708e20c66b2761d878a2bc3c7534e7f814e4dec5
`6dba940352038b56db9b591b172fb2ec76a5fd5e`	affected	< 9f2bfea51151dfbb24b52f452eb3d5f5fe0e506e
`6dba940352038b56db9b591b172fb2ec76a5fd5e`	affected	< 57536ff0a6bd69a5808d682925202babdb5ddc13
`6dba940352038b56db9b591b172fb2ec76a5fd5e`	affected	< b33f8d816950b10e7879cd8ffd7ae4b649ada4db
`6dba940352038b56db9b591b172fb2ec76a5fd5e`	affected	< 95d848dc7e639988dbb385a8cba9b484607cf98c

Linux

affected

Version	Status	Constraints
`5.14`	affected	—
`0`	unaffected	< 5.14
`6.1.165`	unaffected	≤ 6.1.*
`6.6.128`	unaffected	≤ 6.6.*
`6.12.75`	unaffected	≤ 6.12.*
`6.18.16`	unaffected	≤ 6.18.*
`6.19.6`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6dba940352038b56db9b591b172fb2ec76a5fd5e, f621ca24f9f489e226e22560761b04884984133b)`	affected	code_commit	—
`[6dba940352038b56db9b591b172fb2ec76a5fd5e, 708e20c66b2761d878a2bc3c7534e7f814e4dec5)`	affected	code_commit	—
`[6dba940352038b56db9b591b172fb2ec76a5fd5e, 9f2bfea51151dfbb24b52f452eb3d5f5fe0e506e)`	affected	code_commit	—
`[6dba940352038b56db9b591b172fb2ec76a5fd5e, 57536ff0a6bd69a5808d682925202babdb5ddc13)`	affected	code_commit	—
`[6dba940352038b56db9b591b172fb2ec76a5fd5e, b33f8d816950b10e7879cd8ffd7ae4b649ada4db)`	affected	code_commit	—
`[6dba940352038b56db9b591b172fb2ec76a5fd5e, 95d848dc7e639988dbb385a8cba9b484607cf98c)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.14`	affected	generic	—
`[0,5.14)`	unaffected	generic	—
`[6.1.165,6.2.0)`	unaffected	semver	—
`[6.6.128,6.7.0)`	unaffected	semver	—
`[6.12.75,6.13.0)`	unaffected	semver	—
`[6.18.16,6.19.0)`	unaffected	semver	—
`[6.19.6,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel update that includes the SRCU protection patch for __get_sregs2()
If the patch cannot be applied immediately, disable or restrict KVM usage on affected hosts
Monitor kernel logs for lockdep warnings or unexpected KVM‑related crashes and run regular kernel stability tests

Generated by OpenCVE AI on May 6, 2026 at 16:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/57536ff0a6bd69a5808d682925202babdb5ddc13
https://git.kernel.org/stable/c/708e20c66b2761d878a2bc3c7534e7f814e4dec5
https://git.kernel.org/stable/c/95d848dc7e639988dbb385a8cba9b484607cf98c
https://git.kernel.org/stable/c/9f2bfea51151dfbb24b52f452eb3d5f5fe0e506e
https://git.kernel.org/stable/c/b33f8d816950b10e7879cd8ffd7ae4b649ada4db
https://git.kernel.org/stable/c/f621ca24f9f489e226e22560761b04884984133b

History

Wed, 06 May 2026 16:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362

Wed, 06 May 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() Add SRCU read-side protection when reading PDPTR registers in __get_sregs2(). Reading PDPTRs may trigger access to guest memory: kvm_pdptr_read() -> svm_cache_reg() -> load_pdptrs() -> kvm_vcpu_read_guest_page() -> kvm_vcpu_gfn_to_memslot() kvm_vcpu_gfn_to_memslot() dereferences memslots via __kvm_memslots(), which uses srcu_dereference_check() and requires either kvm->srcu or kvm->slots_lock to be held. Currently only vcpu->mutex is held, triggering lockdep warning: ============================= WARNING: suspicious RCU usage in kvm_vcpu_gfn_to_memslot 6.12.59+ #3 Not tainted include/linux/kvm_host.h:1062 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by syz.5.1717/15100: #0: ff1100002f4b00b0 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x1d5/0x1590 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xf0/0x120 lib/dump_stack.c:120 lockdep_rcu_suspicious+0x1e3/0x270 kernel/locking/lockdep.c:6824 __kvm_memslots include/linux/kvm_host.h:1062 [inline] __kvm_memslots include/linux/kvm_host.h:1059 [inline] kvm_vcpu_memslots include/linux/kvm_host.h:1076 [inline] kvm_vcpu_gfn_to_memslot+0x518/0x5e0 virt/kvm/kvm_main.c:2617 kvm_vcpu_read_guest_page+0x27/0x50 virt/kvm/kvm_main.c:3302 load_pdptrs+0xff/0x4b0 arch/x86/kvm/x86.c:1065 svm_cache_reg+0x1c9/0x230 arch/x86/kvm/svm/svm.c:1688 kvm_pdptr_read arch/x86/kvm/kvm_cache_regs.h:141 [inline] __get_sregs2 arch/x86/kvm/x86.c:11784 [inline] kvm_arch_vcpu_ioctl+0x3e20/0x4aa0 arch/x86/kvm/x86.c:6279 kvm_vcpu_ioctl+0x856/0x1590 virt/kvm/kvm_main.c:4663 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xbd/0x1d0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Title		KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/57536ff0a6bd69a5808d682925202babdb5ddc13 https://git.kernel.org/stable/c/708e20c66b2761d878a2bc3c7534e7f814e4dec5 https://git.kernel.org/stable/c/95d848dc7e639988dbb385a8cba9b484607cf98c https://git.kernel.org/stable/c/9f2bfea51151dfbb24b52f452eb3d5f5fe0e506e https://git.kernel.org/stable/c/b33f8d816950b10e7879cd8ffd7ae4b649ada4db https://git.kernel.org/stable/c/f621ca24f9f489e226e22560761b04884984133b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-06T11:28:16.766Z

Updated: 2026-05-06T11:28:16.766Z

Reserved: 2026-05-01T14:12:55.993Z

Link: CVE-2026-43214

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-05-06T12:16:40.920

Modified: 2026-05-06T13:07:51.607

Link: CVE-2026-43214

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-05-06T17:30:07Z

Weaknesses

CWE-362

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object