Description

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Always update x2APIC MSR intercepts for L1 when AVIC is deactivated, even if L2 is active and KVM is using a separate MSR bitmap to run L2. If AVIC is fully enabled prior to running L2, and is then inhibited while L2 is active (for a VM-scoped inhibit), then KVM will run L1 with AVIC disabled, but with x2APIC MSR intercepts disabled, i.e. will allow L1 to read most of the host's APIC state, send arbitrary interrupts, change task priority, and ultimately trivially DoS the host. E.g. sending a self-IPI in L1 on HYPERV_REENLIGHTENMENT_VECTOR, 0xee, with CONFIG_HYPERV=n in the host kernel as a "safe" PoC, yields: Spurious interrupt (vector 0xee) on CPU#425. Acked And hacking KVM to abuse kvm_set_posted_intr_wakeup_handler() to register a handler and WARN on POSTED_INTR_WAKEUP_VECTOR yields: ------------[ cut here ]------------ WARNING: arch/x86/kvm/svm/svm.c:5594 at pi_wakeup_handler+0x9/0x10 [kvm_amd], CPU#156: nested_x2apic_t/316940 CPU: 156 UID: 0 PID: 316940 Comm: nested_x2apic_t Tainted: G S U Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER Hardware name: Google Astoria-Turin/astoria, BIOS 0.20260209.0-0 02/09/2026 RIP: 0010:pi_wakeup_handler+0x9/0x10 [kvm_amd] Call Trace: <IRQ> sysvec_kvm_posted_intr_wakeup_ipi+0x64/0x80 </IRQ> <TASK> asm_sysvec_kvm_posted_intr_wakeup_ipi+0x1a/0x20 RIP: 0010:vcpu_run+0x1430/0x1e40 [kvm] kvm_arch_vcpu_ioctl_run+0x2c1/0x600 [kvm] kvm_vcpu_ioctl+0x580/0x6b0 [kvm] __se_sys_ioctl+0x6d/0xb0 do_syscall_64+0x10a/0x480 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x46ff4b </TASK> ---[ end trace 0000000000000000 ]---

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-15T13:17:56.737Z",
  "pubdate": "2026-08-15T13:17:56.737Z",
  "executiveSummary": "A privilege escalation and denial-of-service vulnerability exists in the Linux kernel's KVM subsystem for AMD Secure Virtual Machine (SVM). The flaw specifically relates to how x2APIC MSR intercepts are handled when the Advanced Virtual Interrupt Controller (AVIC) is inhibited while L2 guest execution is active.\nIf AVIC is fully enabled before running L2 and is subsequently inhibited for a VM-scoped reason while L2 is active, KVM runs L1 with AVIC disabled but incorrectly leaves x2APIC MSR intercepts disabled. This misconfiguration allows an L1 guest to bypass virtualization barriers and directly read host APIC state, send arbitrary interrupts, and modify task priorities.\nAn unprivileged attacker with access to an L1 guest context can exploit this flaw to cause a Denial of Service (DoS) against the host system, such as by sending arbitrary self-interrupters or manipulating posted interrupt handling. Exploitation requires local code execution within a guest virtual machine with nested virtualization features enabled or exposed.\nThe risk is critical for multi-tenant virtualization environments where untrusted guests run with nested virtualization or where VM-scoped AVIC inhibits can be triggered dynamically during L2 execution.",
  "technicalDetails": "The vulnerability resides in the Linux kernel KVM SVM implementation, specifically within arch/x86/kvm/svm/svm.c. The root cause is the failure to update x2APIC Model-Specific Register (MSR) intercepts for L1 when AVIC is deactivated while L2 is active and KVM utilizes a separate MSR bitmap to execute L2.\nUnder normal operations, when AVIC is active, certain MSR accesses are intercepted or handled via hardware acceleration. However, if a VM-scoped inhibit disables AVIC while L2 is running, KVM transitions L1 to run with AVIC disabled. Due to the missing update logic, the MSR bitmaps are not synchronized to re-enable x2APIC MSR intercepts for L1.\nThis leaves the x2APIC MSR intercepts disabled, effectively granting L1 direct access to privileged APIC operations that should be trapped and managed by the hypervisor. Step-by-step, the attack flow proceeds as follows: First, AVIC is enabled prior to launching an L2 guest. Second, a VM-scoped AVIC inhibit is triggered while L2 remains active. Third, KVM updates the runtime state for L1 with AVIC disabled but omits updating the x2APIC MSR interception bitmaps. Fourth, the L1 guest executes code that accesses x2APIC MSRs or issues self-IPIs (such as HYPERV_REENLIGHTENMENT_VECTOR, 0xee). Finally, the hypervisor fails to intercept these sensitive operations, allowing the guest to corrupt host interrupt states, trigger kernel warnings in pi_wakeup_handler, and crash or degrade the host kernel causing a Denial of Service.\nThe vulnerable component is the vcpu_run function and associated AVIC state machine handlers in the kvm_amd module. The conditions required for exploitation include local access to an L1 virtual machine, host configurations utilizing KVM SVM, and scenarios where AVIC inhibition occurs during active nested virtualization states."
}