Vulnerability-Lookup

GHSA-4WPM-CF5Q-X355

Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-17 06:33

Details

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs

Ignore KVM's internal "service pending PV EOI" request if the vCPU has disabled PV EOIs since the request was made. Asserting that PV EOIs are enabled can fail if reading guest memory in pv_eoi_get_user() fails, i.e. if pv_eoi_test_and_clr_pending() bails early, and the vCPU also disables PV EOIs.

kernel BUG at arch/x86/kvm/lapic.c:3338! Oops: invalid opcode: 0000 [#1] SMP CPU: 4 UID: 1000 PID: 890 Comm: pv_eoi_test Not tainted 7.0.0-d585aa5894d8-vm #337 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:kvm_lapic_sync_from_vapic+0x12b/0x140 [kvm] Call Trace: kvm_arch_vcpu_ioctl_run+0x1075/0x1c30 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0xb40 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Modules linked in: kvm_intel kvm irqbypass ---[ end trace 0000000000000000 ]---

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-72284"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T06:21:59Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs\n\nIgnore KVM\u0027s internal \"service pending PV EOI\" request if the vCPU has\ndisabled PV EOIs since the request was made.  Asserting that PV EOIs are\nenabled can fail if reading guest memory in pv_eoi_get_user() fails, i.e.\nif pv_eoi_test_and_clr_pending() bails early, *and* the vCPU also disables\nPV EOIs.\n\n  kernel BUG at arch/x86/kvm/lapic.c:3338!\n  Oops: invalid opcode: 0000 [#1] SMP\n  CPU: 4 UID: 1000 PID: 890 Comm: pv_eoi_test Not tainted 7.0.0-d585aa5894d8-vm #337 PREEMPT\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  RIP: 0010:kvm_lapic_sync_from_vapic+0x12b/0x140 [kvm]\n  Call Trace:\n   \u003cTASK\u003e\n   kvm_arch_vcpu_ioctl_run+0x1075/0x1c30 [kvm]\n   kvm_vcpu_ioctl+0x2d5/0x980 [kvm]\n   __x64_sys_ioctl+0x8a/0xd0\n   do_syscall_64+0xb5/0xb40\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n   \u003c/TASK\u003e\n  Modules linked in: kvm_intel kvm irqbypass\n  ---[ end trace 0000000000000000 ]---",
  "id": "GHSA-4wpm-cf5q-x355",
  "modified": "2026-08-17T06:33:21Z",
  "published": "2026-08-15T06:32:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72284"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/038b9ce6fafda1babd1e33d52cbc6039747a6d87"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/32bdca80aa81c2cb906f50a88b220ce1ecdc5e6e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8e9f7a95279bf608cf4c331ed89612e28c04564f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9285e4070df2c40585c3d7ec9571faa7a2b97e17"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/97542f15dc4cf6cd3fdc035e482dca54246ddf48"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ebd7845ca0471d251a1cb48d84eb165aff5b7123"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-72284 (GCVE-0-2026-72284)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:42

Title

KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs

Summary

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs Ignore KVM's internal "service pending PV EOI" request if the vCPU has disabled PV EOIs since the request was made. Asserting that PV EOIs are enabled can fail if reading guest memory in pv_eoi_get_user() fails, i.e. if pv_eoi_test_and_clr_pending() bails early, *and* the vCPU also disables PV EOIs. kernel BUG at arch/x86/kvm/lapic.c:3338! Oops: invalid opcode: 0000 [#1] SMP CPU: 4 UID: 1000 PID: 890 Comm: pv_eoi_test Not tainted 7.0.0-d585aa5894d8-vm #337 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:kvm_lapic_sync_from_vapic+0x12b/0x140 [kvm] Call Trace: <TASK> kvm_arch_vcpu_ioctl_run+0x1075/0x1c30 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0xb40 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> Modules linked in: kvm_intel kvm irqbypass ---[ end trace 0000000000000000 ]---

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/038b9ce6fafda1bab…
https://git.kernel.org/stable/c/8e9f7a95279bf608c…
https://git.kernel.org/stable/c/ebd7845ca0471d251…
https://git.kernel.org/stable/c/97542f15dc4cf6cd3…
https://git.kernel.org/stable/c/32bdca80aa81c2cb9…
https://git.kernel.org/stable/c/9285e4070df2c4058…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb , < 038b9ce6fafda1babd1e33d52cbc6039747a6d87 (git) Affected: ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb , < 8e9f7a95279bf608cf4c331ed89612e28c04564f (git) Affected: ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb , < ebd7845ca0471d251a1cb48d84eb165aff5b7123 (git) Affected: ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb , < 97542f15dc4cf6cd3fdc035e482dca54246ddf48 (git) Affected: ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb , < 32bdca80aa81c2cb906f50a88b220ce1ecdc5e6e (git) Affected: ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb , < 9285e4070df2c40585c3d7ec9571faa7a2b97e17 (git)
Linux	Linux	Affected: 3.6 Unaffected: 0 , < 3.6 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/lapic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "038b9ce6fafda1babd1e33d52cbc6039747a6d87",
              "status": "affected",
              "version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb",
              "versionType": "git"
            },
            {
              "lessThan": "8e9f7a95279bf608cf4c331ed89612e28c04564f",
              "status": "affected",
              "version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb",
              "versionType": "git"
            },
            {
              "lessThan": "ebd7845ca0471d251a1cb48d84eb165aff5b7123",
              "status": "affected",
              "version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb",
              "versionType": "git"
            },
            {
              "lessThan": "97542f15dc4cf6cd3fdc035e482dca54246ddf48",
              "status": "affected",
              "version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb",
              "versionType": "git"
            },
            {
              "lessThan": "32bdca80aa81c2cb906f50a88b220ce1ecdc5e6e",
              "status": "affected",
              "version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb",
              "versionType": "git"
            },
            {
              "lessThan": "9285e4070df2c40585c3d7ec9571faa7a2b97e17",
              "status": "affected",
              "version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/lapic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.6"
            },
            {
              "lessThan": "3.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs\n\nIgnore KVM\u0027s internal \"service pending PV EOI\" request if the vCPU has\ndisabled PV EOIs since the request was made.  Asserting that PV EOIs are\nenabled can fail if reading guest memory in pv_eoi_get_user() fails, i.e.\nif pv_eoi_test_and_clr_pending() bails early, *and* the vCPU also disables\nPV EOIs.\n\n  kernel BUG at arch/x86/kvm/lapic.c:3338!\n  Oops: invalid opcode: 0000 [#1] SMP\n  CPU: 4 UID: 1000 PID: 890 Comm: pv_eoi_test Not tainted 7.0.0-d585aa5894d8-vm #337 PREEMPT\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  RIP: 0010:kvm_lapic_sync_from_vapic+0x12b/0x140 [kvm]\n  Call Trace:\n   \u003cTASK\u003e\n   kvm_arch_vcpu_ioctl_run+0x1075/0x1c30 [kvm]\n   kvm_vcpu_ioctl+0x2d5/0x980 [kvm]\n   __x64_sys_ioctl+0x8a/0xd0\n   do_syscall_64+0xb5/0xb40\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n   \u003c/TASK\u003e\n  Modules linked in: kvm_intel kvm irqbypass\n  ---[ end trace 0000000000000000 ]---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached when malicious guest code in an x86 KVM VM races paravirtual EOI state, causing kvm_lapic_sync_from_vapic() to run on VM exit via KVM_RUN; this requires local guest execution on a KVM host, not remote network packets to the host kernel.\nAC:L - The attacker controls both sides of the race: guest wrmsr to MSR_KVM_PV_EOI_EN disables PV EOI while KVM_APIC_PV_EOI_PENDING remains set, then any VM exit reliably hits BUG_ON; optional guest memory unmapping can also force pv_eoi_get_user() failure without uncontrollable host timing.\nPR:N - No host root or init-namespace capabilities are required; exploitation needs only code execution inside an assigned KVM guest with KVM_FEATURE_PV_EOI (default on Linux/QEMU guests), typical for any cloud VM tenant without privileged host access.\nUI:N - No victim user or administrator action is required beyond the attacker operating their own guest workload; triggering is fully automated via guest MSR writes and deliberate VM exits that drive the KVM_RUN return path.\nS:C - A guest-triggered BUG_ON in host KVM LAPIC code panics the physical host kernel and denies all co-resident VMs, crossing the guest-to-host KVM virtualization security boundary even though exploitation is denial-of-service rather than memory corruption.\nC:N - The failure mode is BUG_ON in apic_sync_pv_eoi_from_guest with no out-of-bounds access, use-after-free, or memory corruption; it is a deterministic assertion panic without an information disclosure or memory-read primitive.\nI:N - No guest-controlled kernel memory write or control-flow hijack occurs; the host kernel aborts via BUG_ON before any exploitable state mutation beyond crashing the host, and the bug is a stale pending-bit assertion not type confusion.\nA:H - BUG_ON in kvm_lapic_sync_from_vapic provokes a host kernel oops/panic during KVM_RUN VM-exit processing, immediately denying availability of the hypervisor and every VM on the affected x86 KVM host; the attack is repeatable while PV EOI remains enabled for the guest."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:42:19.282Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/038b9ce6fafda1babd1e33d52cbc6039747a6d87"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e9f7a95279bf608cf4c331ed89612e28c04564f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ebd7845ca0471d251a1cb48d84eb165aff5b7123"
        },
        {
          "url": "https://git.kernel.org/stable/c/97542f15dc4cf6cd3fdc035e482dca54246ddf48"
        },
        {
          "url": "https://git.kernel.org/stable/c/32bdca80aa81c2cb906f50a88b220ce1ecdc5e6e"
        },
        {
          "url": "https://git.kernel.org/stable/c/9285e4070df2c40585c3d7ec9571faa7a2b97e17"
        }
      ],
      "title": "KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72284",
    "datePublished": "2026-08-15T05:55:07.765Z",
    "dateReserved": "2026-08-09T03:40:39.917Z",
    "dateUpdated": "2026-08-17T05:42:19.282Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-4WPM-CF5Q-X355

CVE-2026-72284 (GCVE-0-2026-72284)

Tags

Sightings

Nomenclature