GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72284 (GCVE-0-2026-72284)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:42
VLAI
Title
KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs Ignore KVM's internal "service pending PV EOI" request if the vCPU has disabled PV EOIs since the request was made. Asserting that PV EOIs are enabled can fail if reading guest memory in pv_eoi_get_user() fails, i.e. if pv_eoi_test_and_clr_pending() bails early, *and* the vCPU also disables PV EOIs. kernel BUG at arch/x86/kvm/lapic.c:3338! Oops: invalid opcode: 0000 [#1] SMP CPU: 4 UID: 1000 PID: 890 Comm: pv_eoi_test Not tainted 7.0.0-d585aa5894d8-vm #337 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:kvm_lapic_sync_from_vapic+0x12b/0x140 [kvm] Call Trace: <TASK> kvm_arch_vcpu_ioctl_run+0x1075/0x1c30 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0xb40 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> Modules linked in: kvm_intel kvm irqbypass ---[ end trace 0000000000000000 ]---
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb , < 038b9ce6fafda1babd1e33d52cbc6039747a6d87 (git)
Affected: ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb , < 8e9f7a95279bf608cf4c331ed89612e28c04564f (git)
Affected: ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb , < ebd7845ca0471d251a1cb48d84eb165aff5b7123 (git)
Affected: ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb , < 97542f15dc4cf6cd3fdc035e482dca54246ddf48 (git)
Affected: ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb , < 32bdca80aa81c2cb906f50a88b220ce1ecdc5e6e (git)
Affected: ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb , < 9285e4070df2c40585c3d7ec9571faa7a2b97e17 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.6
Unaffected: 0 , < 3.6 (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/lapic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "038b9ce6fafda1babd1e33d52cbc6039747a6d87",
              "status": "affected",
              "version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb",
              "versionType": "git"
            },
            {
              "lessThan": "8e9f7a95279bf608cf4c331ed89612e28c04564f",
              "status": "affected",
              "version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb",
              "versionType": "git"
            },
            {
              "lessThan": "ebd7845ca0471d251a1cb48d84eb165aff5b7123",
              "status": "affected",
              "version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb",
              "versionType": "git"
            },
            {
              "lessThan": "97542f15dc4cf6cd3fdc035e482dca54246ddf48",
              "status": "affected",
              "version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb",
              "versionType": "git"
            },
            {
              "lessThan": "32bdca80aa81c2cb906f50a88b220ce1ecdc5e6e",
              "status": "affected",
              "version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb",
              "versionType": "git"
            },
            {
              "lessThan": "9285e4070df2c40585c3d7ec9571faa7a2b97e17",
              "status": "affected",
              "version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/lapic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.6"
            },
            {
              "lessThan": "3.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs\n\nIgnore KVM\u0027s internal \"service pending PV EOI\" request if the vCPU has\ndisabled PV EOIs since the request was made.  Asserting that PV EOIs are\nenabled can fail if reading guest memory in pv_eoi_get_user() fails, i.e.\nif pv_eoi_test_and_clr_pending() bails early, *and* the vCPU also disables\nPV EOIs.\n\n  kernel BUG at arch/x86/kvm/lapic.c:3338!\n  Oops: invalid opcode: 0000 [#1] SMP\n  CPU: 4 UID: 1000 PID: 890 Comm: pv_eoi_test Not tainted 7.0.0-d585aa5894d8-vm #337 PREEMPT\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  RIP: 0010:kvm_lapic_sync_from_vapic+0x12b/0x140 [kvm]\n  Call Trace:\n   \u003cTASK\u003e\n   kvm_arch_vcpu_ioctl_run+0x1075/0x1c30 [kvm]\n   kvm_vcpu_ioctl+0x2d5/0x980 [kvm]\n   __x64_sys_ioctl+0x8a/0xd0\n   do_syscall_64+0xb5/0xb40\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n   \u003c/TASK\u003e\n  Modules linked in: kvm_intel kvm irqbypass\n  ---[ end trace 0000000000000000 ]---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached when malicious guest code in an x86 KVM VM races paravirtual EOI state, causing kvm_lapic_sync_from_vapic() to run on VM exit via KVM_RUN; this requires local guest execution on a KVM host, not remote network packets to the host kernel.\nAC:L - The attacker controls both sides of the race: guest wrmsr to MSR_KVM_PV_EOI_EN disables PV EOI while KVM_APIC_PV_EOI_PENDING remains set, then any VM exit reliably hits BUG_ON; optional guest memory unmapping can also force pv_eoi_get_user() failure without uncontrollable host timing.\nPR:N - No host root or init-namespace capabilities are required; exploitation needs only code execution inside an assigned KVM guest with KVM_FEATURE_PV_EOI (default on Linux/QEMU guests), typical for any cloud VM tenant without privileged host access.\nUI:N - No victim user or administrator action is required beyond the attacker operating their own guest workload; triggering is fully automated via guest MSR writes and deliberate VM exits that drive the KVM_RUN return path.\nS:C - A guest-triggered BUG_ON in host KVM LAPIC code panics the physical host kernel and denies all co-resident VMs, crossing the guest-to-host KVM virtualization security boundary even though exploitation is denial-of-service rather than memory corruption.\nC:N - The failure mode is BUG_ON in apic_sync_pv_eoi_from_guest with no out-of-bounds access, use-after-free, or memory corruption; it is a deterministic assertion panic without an information disclosure or memory-read primitive.\nI:N - No guest-controlled kernel memory write or control-flow hijack occurs; the host kernel aborts via BUG_ON before any exploitable state mutation beyond crashing the host, and the bug is a stale pending-bit assertion not type confusion.\nA:H - BUG_ON in kvm_lapic_sync_from_vapic provokes a host kernel oops/panic during KVM_RUN VM-exit processing, immediately denying availability of the hypervisor and every VM on the affected x86 KVM host; the attack is repeatable while PV EOI remains enabled for the guest."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:42:19.282Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/038b9ce6fafda1babd1e33d52cbc6039747a6d87"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e9f7a95279bf608cf4c331ed89612e28c04564f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ebd7845ca0471d251a1cb48d84eb165aff5b7123"
        },
        {
          "url": "https://git.kernel.org/stable/c/97542f15dc4cf6cd3fdc035e482dca54246ddf48"
        },
        {
          "url": "https://git.kernel.org/stable/c/32bdca80aa81c2cb906f50a88b220ce1ecdc5e6e"
        },
        {
          "url": "https://git.kernel.org/stable/c/9285e4070df2c40585c3d7ec9571faa7a2b97e17"
        }
      ],
      "title": "KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72284",
    "datePublished": "2026-08-15T05:55:07.765Z",
    "dateReserved": "2026-08-09T03:40:39.917Z",
    "dateUpdated": "2026-08-17T05:42:19.282Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72284",
      "date": "2026-09-05",
      "epss": "0.00187",
      "percentile": "0.08334"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72284\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:21:59.240\",\"lastModified\":\"2026-08-17T06:18:31.057\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs\\n\\nIgnore KVM\u0027s internal \\\"service pending PV EOI\\\" request if the vCPU has\\ndisabled PV EOIs since the request was made.  Asserting that PV EOIs are\\nenabled can fail if reading guest memory in pv_eoi_get_user() fails, i.e.\\nif pv_eoi_test_and_clr_pending() bails early, *and* the vCPU also disables\\nPV EOIs.\\n\\n  kernel BUG at arch/x86/kvm/lapic.c:3338!\\n  Oops: invalid opcode: 0000 [#1] SMP\\n  CPU: 4 UID: 1000 PID: 890 Comm: pv_eoi_test Not tainted 7.0.0-d585aa5894d8-vm #337 PREEMPT\\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\\n  RIP: 0010:kvm_lapic_sync_from_vapic+0x12b/0x140 [kvm]\\n  Call Trace:\\n   \u003cTASK\u003e\\n   kvm_arch_vcpu_ioctl_run+0x1075/0x1c30 [kvm]\\n   kvm_vcpu_ioctl+0x2d5/0x980 [kvm]\\n   __x64_sys_ioctl+0x8a/0xd0\\n   do_syscall_64+0xb5/0xb40\\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\\n   \u003c/TASK\u003e\\n  Modules linked in: kvm_intel kvm irqbypass\\n  ---[ end trace 0000000000000000 ]---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/kvm/lapic.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb\",\"lessThan\":\"038b9ce6fafda1babd1e33d52cbc6039747a6d87\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb\",\"lessThan\":\"8e9f7a95279bf608cf4c331ed89612e28c04564f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb\",\"lessThan\":\"ebd7845ca0471d251a1cb48d84eb165aff5b7123\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb\",\"lessThan\":\"97542f15dc4cf6cd3fdc035e482dca54246ddf48\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb\",\"lessThan\":\"32bdca80aa81c2cb906f50a88b220ce1ecdc5e6e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb\",\"lessThan\":\"9285e4070df2c40585c3d7ec9571faa7a2b97e17\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/kvm/lapic.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":4.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/038b9ce6fafda1babd1e33d52cbc6039747a6d87\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/32bdca80aa81c2cb906f50a88b220ce1ecdc5e6e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8e9f7a95279bf608cf4c331ed89612e28c04564f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9285e4070df2c40585c3d7ec9571faa7a2b97e17\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/97542f15dc4cf6cd3fdc035e482dca54246ddf48\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ebd7845ca0471d251a1cb48d84eb165aff5b7123\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T19:37:23+00:00",
      "cve": "CVE-2026-72284",
      "id": "CVE-2026-72284",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72284.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.