CVE-2026-64604 - Vulnerability Details

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode

When updating CR8 intercepts, get vmcs12 if and only if the vCPU is in
guest mode so that a future change can have update CR8 intercepts during
vCPU creation, without running afoul of get_vmcs12()'s lockdep assertion.

------------[ cut here ]------------
debug_locks && !(lock_is_held(&(&vcpu->mutex)->dep_map) || !refcount_read(&vcpu->kvm->users_count))
WARNING: arch/x86/kvm/vmx/nested.h:61 at get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline], CPU#0: syz.2.19/5879
WARNING: arch/x86/kvm/vmx/nested.h:61 at vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879, CPU#0: syz.2.19/5879
Modules linked in:
CPU: 0 UID: 0 PID: 5879 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline]
RIP: 0010:vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879
Call Trace:
<TASK>
apic_update_ppr arch/x86/kvm/lapic.c:984 [inline]
kvm_lapic_reset+0x1c24/0x2980 arch/x86/kvm/lapic.c:3023
kvm_vcpu_reset+0x44c/0x1bf0 arch/x86/kvm/x86.c:12986
kvm_arch_vcpu_create+0x746/0x8b0 arch/x86/kvm/x86.c:12847
kvm_vm_ioctl_create_vcpu+0x428/0x930 virt/kvm/kvm_main.c:4201
kvm_vm_ioctl+0x893/0xd50 virt/kvm/kvm_main.c:5159
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>

No functional change intended.

Published: 2026-08-06

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability resides in the Linux kernel’s virtual machine manager for Intel’s VT-x (KVM: VMX). It causes the kernel to attempt to grab the vmcs12 data structure only when the virtual CPU (vCPU) is in guest mode, leading to a lockdep failure during CR8 interception updates. This excessive assertion can break kernel execution flow, potentially resulting in a kernel panic or an unresponsive system. The weakness is a concurrency and lock order flaw, exposing the kernel to a denial‑of‑service scenario if an attacker can trigger the condition through KVM interfaces.

Affected Systems

All Linux kernel binaries that include the KVM virtualization code are affected. The issue appears in the kernel package, regardless of distribution, as the CPE string indicates cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*. No specific version range is given, but the commit URLs point to fixes in the mainline kernel development branch.

Risk and Exploitability

No functional change was intended and the EPSS score is not available, indicating no publicly known exploitation activity. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to interact with the KVM module, passing VCPU parameters that trigger the lockdep assertion, which requires kernel execution privileges or privileged VM manipulation. Consequently the overall exploitation risk is considered low, though the impact of a kernel crash is high to the affected host.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< c7cd3605244c924249dea32632e1bc3e89bda543
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 9a21f1defd96c6301c5fb462a78eb51b191bd2dd
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 570af5db081b87374594a00711ac5760d2ea6844
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< ffaaff82336db84e9b58e7a3e81c2fd64e05ed7a
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 258ec63c0f281bf7b50f9de67c8e93b5b7be5ed4
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 3dcfb04dd43b16fa1240fc6487fff578ad57264c
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< db8407b9fd06d857a4a5e8bcff1d086d13007711
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 7ef78d71ca713d8c00f7c34ddcf276c808143f77
`0`	affected	< 5.10.261
`0`	affected	< 5.15.212
`0`	affected	< 6.1.178
`0`	affected	< 6.6.145
`0`	affected	< 6.12.96
`0`	affected	< 6.18.39
`0`	affected	< 7.1.4

Linux

affected

Version	Status	Constraints
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c7cd3605244c924249dea32632e1bc3e89bda543)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9a21f1defd96c6301c5fb462a78eb51b191bd2dd)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,570af5db081b87374594a00711ac5760d2ea6844)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ffaaff82336db84e9b58e7a3e81c2fd64e05ed7a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,258ec63c0f281bf7b50f9de67c8e93b5b7be5ed4)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3dcfb04dd43b16fa1240fc6487fff578ad57264c)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,db8407b9fd06d857a4a5e8bcff1d086d13007711)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7ef78d71ca713d8c00f7c34ddcf276c808143f77)`	affected	code_commit	—
`[0,5.10.261)`	affected	semver	—
`[0,5.15.212)`	affected	semver	—
`[0,6.1.178)`	affected	semver	—
`[0,6.6.145)`	affected	semver	—
`[0,6.12.96)`	affected	semver	—
`[0,6.18.39)`	affected	semver	—
`[0,7.1.4)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to the latest stable release that incorporates the patch found in commit 258ec63c0f281bf7b50f9de67c8e93b5b7be5ed4 and its associated downstream commits
Rebuild any kernel modules that depend on KVM and reinstall them to ensure the updated kernel binaries are fully loaded
After updating, verify that no lockdep assertions related to vmcs12 or CR8 interception appear in the kernel logs (dmesg) and that normal KVM operation resumes

Generated by OpenCVE AI on August 6, 2026 at 08:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00164.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/258ec63c0f281bf7b50f9de67c8e93b5b7be5ed4
https://git.kernel.org/stable/c/3dcfb04dd43b16fa1240fc6487fff578ad57264c
https://git.kernel.org/stable/c/570af5db081b87374594a00711ac5760d2ea6844
https://git.kernel.org/stable/c/7ef78d71ca713d8c00f7c34ddcf276c808143f77
https://git.kernel.org/stable/c/9a21f1defd96c6301c5fb462a78eb51b191bd2dd
https://git.kernel.org/stable/c/c7cd3605244c924249dea32632e1bc3e89bda543
https://git.kernel.org/stable/c/db8407b9fd06d857a4a5e8bcff1d086d13007711
https://git.kernel.org/stable/c/ffaaff82336db84e9b58e7a3e81c2fd64e05ed7a

History

Thu, 06 Aug 2026 09:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-247 CWE-362

Thu, 06 Aug 2026 07:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode When updating CR8 intercepts, get vmcs12 if and only if the vCPU is in guest mode so that a future change can have update CR8 intercepts during vCPU creation, without running afoul of get_vmcs12()'s lockdep assertion. ------------[ cut here ]------------ debug_locks && !(lock_is_held(&(&vcpu->mutex)->dep_map) \|\| !refcount_read(&vcpu->kvm->users_count)) WARNING: arch/x86/kvm/vmx/nested.h:61 at get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline], CPU#0: syz.2.19/5879 WARNING: arch/x86/kvm/vmx/nested.h:61 at vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879, CPU#0: syz.2.19/5879 Modules linked in: CPU: 0 UID: 0 PID: 5879 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline] RIP: 0010:vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879 Call Trace: <TASK> apic_update_ppr arch/x86/kvm/lapic.c:984 [inline] kvm_lapic_reset+0x1c24/0x2980 arch/x86/kvm/lapic.c:3023 kvm_vcpu_reset+0x44c/0x1bf0 arch/x86/kvm/x86.c:12986 kvm_arch_vcpu_create+0x746/0x8b0 arch/x86/kvm/x86.c:12847 kvm_vm_ioctl_create_vcpu+0x428/0x930 virt/kvm/kvm_main.c:4201 kvm_vm_ioctl+0x893/0xd50 virt/kvm/kvm_main.c:5159 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> No functional change intended.
Title		KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/258ec63c0f281bf7b50f9de67c8e93b5b7be5ed4 https://git.kernel.org/stable/c/3dcfb04dd43b16fa1240fc6487fff578ad57264c https://git.kernel.org/stable/c/570af5db081b87374594a00711ac5760d2ea6844 https://git.kernel.org/stable/c/7ef78d71ca713d8c00f7c34ddcf276c808143f77 https://git.kernel.org/stable/c/9a21f1defd96c6301c5fb462a78eb51b191bd2dd https://git.kernel.org/stable/c/c7cd3605244c924249dea32632e1bc3e89bda543 https://git.kernel.org/stable/c/db8407b9fd06d857a4a5e8bcff1d086d13007711 https://git.kernel.org/stable/c/ffaaff82336db84e9b58e7a3e81c2fd64e05ed7a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-06T07:13:55.718Z

Updated: 2026-08-06T07:13:55.718Z

Reserved: 2026-07-19T15:36:31.799Z

Link: CVE-2026-64604

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-06T09:15:02Z

Weaknesses

CWE-247
DEPRECATED: Reliance on DNS Lookups in a Security Decision
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object