CVE-2026-43214 - Vulnerability Details

- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()

Add SRCU read-side protection when reading PDPTR registers in
__get_sregs2().

Reading PDPTRs may trigger access to guest memory:
kvm_pdptr_read() -> svm_cache_reg() -> load_pdptrs() ->
kvm_vcpu_read_guest_page() -> kvm_vcpu_gfn_to_memslot()

kvm_vcpu_gfn_to_memslot() dereferences memslots via __kvm_memslots(),
which uses srcu_dereference_check() and requires either kvm->srcu or
kvm->slots_lock to be held. Currently only vcpu->mutex is held,
triggering lockdep warning:

=============================
WARNING: suspicious RCU usage in kvm_vcpu_gfn_to_memslot
6.12.59+ #3 Not tainted

include/linux/kvm_host.h:1062 suspicious rcu_dereference_check() usage!

other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1
1 lock held by syz.5.1717/15100:
#0: ff1100002f4b00b0 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x1d5/0x1590

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0xf0/0x120 lib/dump_stack.c:120
lockdep_rcu_suspicious+0x1e3/0x270 kernel/locking/lockdep.c:6824
__kvm_memslots include/linux/kvm_host.h:1062 [inline]
__kvm_memslots include/linux/kvm_host.h:1059 [inline]
kvm_vcpu_memslots include/linux/kvm_host.h:1076 [inline]
kvm_vcpu_gfn_to_memslot+0x518/0x5e0 virt/kvm/kvm_main.c:2617
kvm_vcpu_read_guest_page+0x27/0x50 virt/kvm/kvm_main.c:3302
load_pdptrs+0xff/0x4b0 arch/x86/kvm/x86.c:1065
svm_cache_reg+0x1c9/0x230 arch/x86/kvm/svm/svm.c:1688
kvm_pdptr_read arch/x86/kvm/kvm_cache_regs.h:141 [inline]
__get_sregs2 arch/x86/kvm/x86.c:11784 [inline]
kvm_arch_vcpu_ioctl+0x3e20/0x4aa0 arch/x86/kvm/x86.c:6279
kvm_vcpu_ioctl+0x856/0x1590 virt/kvm/kvm_main.c:4663
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xbd/0x1d0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Published: 2026-05-06

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Based on the description, it is inferred that the Linux kernel KVM hypervisor contains a bug in the __get_sregs2() function, where reading the PDPTR registers occurs without SRCU protection. This flaw, recorded as CWE‑820, indicates a concurrency error involving unsynchronized access that bypasses required SRCU checks. In addition, other unspecified weaknesses may be present, as indicated by the inclusion of NVD-CWE-noinfo.

Affected Systems

Affected systems are all x86 Linux kernel releases that include the KVM hypervisor but do not contain the SRCU guard in __get_sregs2(). No specific distribution or patch revision is mentioned, so any kernel build before the change is considered vulnerable.

Risk and Exploitability

The CVSS score is 7.8, and the EPSS score is less than 1%, indicating a very low probability of exploitation in real‑world scenarios. The likely attack vector is via the KVM ioctl interface from within a guest or a privileged host process; this inference comes from the fact that the vulnerability involves a KVM ioctl path. While the attack remains narrow and would require crafted input, the potential to corrupt kernel memory or cause a crash could lead to denial of service or loss of integrity for the host. Operators should regard the patch as essential to mitigate this risk.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`6dba940352038b56db9b591b172fb2ec76a5fd5e`	affected	< f621ca24f9f489e226e22560761b04884984133b
`6dba940352038b56db9b591b172fb2ec76a5fd5e`	affected	< 708e20c66b2761d878a2bc3c7534e7f814e4dec5
`6dba940352038b56db9b591b172fb2ec76a5fd5e`	affected	< 9f2bfea51151dfbb24b52f452eb3d5f5fe0e506e
`6dba940352038b56db9b591b172fb2ec76a5fd5e`	affected	< 57536ff0a6bd69a5808d682925202babdb5ddc13
`6dba940352038b56db9b591b172fb2ec76a5fd5e`	affected	< b33f8d816950b10e7879cd8ffd7ae4b649ada4db
`6dba940352038b56db9b591b172fb2ec76a5fd5e`	affected	< 95d848dc7e639988dbb385a8cba9b484607cf98c

Linux

affected

Version	Status	Constraints
`5.14`	affected	—
`0`	unaffected	< 5.14
`6.1.165`	unaffected	≤ 6.1.*
`6.6.128`	unaffected	≤ 6.6.*
`6.12.75`	unaffected	≤ 6.12.*
`6.18.16`	unaffected	≤ 6.18.*
`6.19.6`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6dba940352038b56db9b591b172fb2ec76a5fd5e, f621ca24f9f489e226e22560761b04884984133b)`	affected	code_commit	—
`[6dba940352038b56db9b591b172fb2ec76a5fd5e, 708e20c66b2761d878a2bc3c7534e7f814e4dec5)`	affected	code_commit	—
`[6dba940352038b56db9b591b172fb2ec76a5fd5e, 9f2bfea51151dfbb24b52f452eb3d5f5fe0e506e)`	affected	code_commit	—
`[6dba940352038b56db9b591b172fb2ec76a5fd5e, 57536ff0a6bd69a5808d682925202babdb5ddc13)`	affected	code_commit	—
`[6dba940352038b56db9b591b172fb2ec76a5fd5e, b33f8d816950b10e7879cd8ffd7ae4b649ada4db)`	affected	code_commit	—
`[6dba940352038b56db9b591b172fb2ec76a5fd5e, 95d848dc7e639988dbb385a8cba9b484607cf98c)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.14`	affected	generic	—
`[0,5.14)`	unaffected	generic	—
`[6.1.165,6.2.0)`	unaffected	semver	—
`[6.6.128,6.7.0)`	unaffected	semver	—
`[6.12.75,6.13.0)`	unaffected	semver	—
`[6.18.16,6.19.0)`	unaffected	semver	—
`[6.19.6,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel update that introduces SRCU protection in __get_sregs2() to fix the concurrency flaw (CWE‑820).
If an immediate patch cannot be deployed, limit KVM usage or run the host under a restricted privilege scope to reduce the attack surface related to the unsynchronized SRCU read.
Monitor the kernel logs for lockdep warnings such as “suspicious RCU usage in kvm_vcpu_gfn_to_memslot” and perform regular stability testing to detect signs of CWE‑820 related race conditions.

Generated by OpenCVE AI on May 11, 2026 at 20:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00013.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/57536ff0a6bd69a5808d682925202babdb5ddc13
https://git.kernel.org/stable/c/708e20c66b2761d878a2bc3c7534e7f814e4dec5
https://git.kernel.org/stable/c/95d848dc7e639988dbb385a8cba9b484607cf98c
https://git.kernel.org/stable/c/9f2bfea51151dfbb24b52f452eb3d5f5fe0e506e
https://git.kernel.org/stable/c/b33f8d816950b10e7879cd8ffd7ae4b649ada4db
https://git.kernel.org/stable/c/f621ca24f9f489e226e22560761b04884984133b
https://lore.kernel.org/linux-cve-announce/2026050650-CVE-2026-43214-37cb@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-43214
https://www.cve.org/CVERecord?id=CVE-2026-43214

History

Mon, 11 May 2026 19:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo

Fri, 08 May 2026 13:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 07 May 2026 04:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362

Thu, 07 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-820
References		https://lore.kernel.org/linux-cve-announce/2026050650-CVE-2026-43214-37cb@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-43214 https://www.cve.org/CVERecord?id=CVE-2026-43214
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Wed, 06 May 2026 16:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362

Wed, 06 May 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() Add SRCU read-side protection when reading PDPTR registers in __get_sregs2(). Reading PDPTRs may trigger access to guest memory: kvm_pdptr_read() -> svm_cache_reg() -> load_pdptrs() -> kvm_vcpu_read_guest_page() -> kvm_vcpu_gfn_to_memslot() kvm_vcpu_gfn_to_memslot() dereferences memslots via __kvm_memslots(), which uses srcu_dereference_check() and requires either kvm->srcu or kvm->slots_lock to be held. Currently only vcpu->mutex is held, triggering lockdep warning: ============================= WARNING: suspicious RCU usage in kvm_vcpu_gfn_to_memslot 6.12.59+ #3 Not tainted include/linux/kvm_host.h:1062 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by syz.5.1717/15100: #0: ff1100002f4b00b0 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x1d5/0x1590 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xf0/0x120 lib/dump_stack.c:120 lockdep_rcu_suspicious+0x1e3/0x270 kernel/locking/lockdep.c:6824 __kvm_memslots include/linux/kvm_host.h:1062 [inline] __kvm_memslots include/linux/kvm_host.h:1059 [inline] kvm_vcpu_memslots include/linux/kvm_host.h:1076 [inline] kvm_vcpu_gfn_to_memslot+0x518/0x5e0 virt/kvm/kvm_main.c:2617 kvm_vcpu_read_guest_page+0x27/0x50 virt/kvm/kvm_main.c:3302 load_pdptrs+0xff/0x4b0 arch/x86/kvm/x86.c:1065 svm_cache_reg+0x1c9/0x230 arch/x86/kvm/svm/svm.c:1688 kvm_pdptr_read arch/x86/kvm/kvm_cache_regs.h:141 [inline] __get_sregs2 arch/x86/kvm/x86.c:11784 [inline] kvm_arch_vcpu_ioctl+0x3e20/0x4aa0 arch/x86/kvm/x86.c:6279 kvm_vcpu_ioctl+0x856/0x1590 virt/kvm/kvm_main.c:4663 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xbd/0x1d0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Title		KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/57536ff0a6bd69a5808d682925202babdb5ddc13 https://git.kernel.org/stable/c/708e20c66b2761d878a2bc3c7534e7f814e4dec5 https://git.kernel.org/stable/c/95d848dc7e639988dbb385a8cba9b484607cf98c https://git.kernel.org/stable/c/9f2bfea51151dfbb24b52f452eb3d5f5fe0e506e https://git.kernel.org/stable/c/b33f8d816950b10e7879cd8ffd7ae4b649ada4db https://git.kernel.org/stable/c/f621ca24f9f489e226e22560761b04884984133b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-06T11:28:16.766Z

Updated: 2026-05-11T22:20:12.642Z

Reserved: 2026-05-01T14:12:55.993Z

Link: CVE-2026-43214

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-05-06T12:16:40.920

Modified: 2026-05-11T19:44:24.010

Link: CVE-2026-43214

Redhat

Severity : Moderate

Publid Date: 2026-05-06T00:00:00Z

Links: CVE-2026-43214 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-11T21:00:14Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object