{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74516", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.910Z", "datePublished": "2026-08-15T12:27:36.200Z", "dateUpdated": "2026-08-15T12:27:36.200Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-15T12:27:36.200Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active\n\nAlways update x2APIC MSR intercepts for L1 when AVIC is deactivated, even\nif L2 is active and KVM is using a separate MSR bitmap to run L2. If AVIC\nis fully enabled prior to running L2, and is then inhibited while L2 is\nactive (for a VM-scoped inhibit), then KVM will run L1 with AVIC disabled,\nbut with x2APIC MSR intercepts disabled, i.e. will allow L1 to read most of\nthe host's APIC state, send arbitrary interrupts, change task priority, and\nultimately trivially DoS the host.\n\nE.g. sending a self-IPI in L1 on HYPERV_REENLIGHTENMENT_VECTOR, 0xee, with\nCONFIG_HYPERV=n in the host kernel as a \"safe\" PoC, yields:\n\n Spurious interrupt (vector 0xee) on CPU#425. Acked\n\nAnd hacking KVM to abuse kvm_set_posted_intr_wakeup_handler() to register a\nhandler and WARN on POSTED_INTR_WAKEUP_VECTOR yields:\n\n ------------[ cut here ]------------\n WARNING: arch/x86/kvm/svm/svm.c:5594 at pi_wakeup_handler+0x9/0x10 [kvm_amd], CPU#156: nested_x2apic_t/316940\n CPU: 156 UID: 0 PID: 316940 Comm: nested_x2apic_t Tainted: G S U\n Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER\n Hardware name: Google Astoria-Turin/astoria, BIOS 0.20260209.0-0 02/09/2026\n RIP: 0010:pi_wakeup_handler+0x9/0x10 [kvm_amd]\n Call Trace:\n <IRQ>\n sysvec_kvm_posted_intr_wakeup_ipi+0x64/0x80\n </IRQ>\n <TASK>\n asm_sysvec_kvm_posted_intr_wakeup_ipi+0x1a/0x20\n RIP: 0010:vcpu_run+0x1430/0x1e40 [kvm]\n kvm_arch_vcpu_ioctl_run+0x2c1/0x600 [kvm]\n kvm_vcpu_ioctl+0x580/0x6b0 [kvm]\n __se_sys_ioctl+0x6d/0xb0\n do_syscall_64+0x10a/0x480\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x46ff4b\n </TASK>\n ---[ end trace 0000000000000000 ]---"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/svm/avic.c"], "versions": [{"version": "091abbf578f926e763adc0f577baeb7f405b4bdc", "lessThan": "6664a5aea45318f4ec156a729949b474dd6e3159", "status": "affected", "versionType": "git"}, {"version": "091abbf578f926e763adc0f577baeb7f405b4bdc", "lessThan": "f12373625b4dc9bcc89c41872648878c73bb9272", "status": "affected", "versionType": "git"}, {"version": "091abbf578f926e763adc0f577baeb7f405b4bdc", "lessThan": "7668c58dcf465559dc7a0d2e95e9cb79cf47454b", "status": "affected", "versionType": "git"}, {"version": "091abbf578f926e763adc0f577baeb7f405b4bdc", "lessThan": "89f9e8398e79c49886766fc24a84c37726231104", "status": "affected", "versionType": "git"}, {"version": "091abbf578f926e763adc0f577baeb7f405b4bdc", "lessThan": "7d3aae206663c4e006b25a1c7a20a4029e67da76", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/svm/avic.c"], "versions": [{"version": "6.0", "status": "affected"}, {"version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.151", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.103", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc6", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.6.151"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.12.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.2-rc6"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6664a5aea45318f4ec156a729949b474dd6e3159"}, {"url": "https://git.kernel.org/stable/c/f12373625b4dc9bcc89c41872648878c73bb9272"}, {"url": "https://git.kernel.org/stable/c/7668c58dcf465559dc7a0d2e95e9cb79cf47454b"}, {"url": "https://git.kernel.org/stable/c/89f9e8398e79c49886766fc24a84c37726231104"}, {"url": "https://git.kernel.org/stable/c/7d3aae206663c4e006b25a1c7a20a4029e67da76"}], "title": "KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/x86/kvm/svm/avic.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6664a5aea45318f4ec156a729949b474dd6e3159", "status": "affected", "version": "091abbf578f926e763adc0f577baeb7f405b4bdc", "versionType": "git"}, {"lessThan": "f12373625b4dc9bcc89c41872648878c73bb9272", "status": "affected", "version": "091abbf578f926e763adc0f577baeb7f405b4bdc", "versionType": "git"}, {"lessThan": "7668c58dcf465559dc7a0d2e95e9cb79cf47454b", "status": "affected", "version": "091abbf578f926e763adc0f577baeb7f405b4bdc", "versionType": "git"}, {"lessThan": "89f9e8398e79c49886766fc24a84c37726231104", "status": "affected", "version": "091abbf578f926e763adc0f577baeb7f405b4bdc", "versionType": "git"}, {"lessThan": "7d3aae206663c4e006b25a1c7a20a4029e67da76", "status": "affected", "version": "091abbf578f926e763adc0f577baeb7f405b4bdc", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/x86/kvm/svm/avic.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.151", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.103", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2-rc6", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active\n\nAlways update x2APIC MSR intercepts for L1 when AVIC is deactivated, even\nif L2 is active and KVM is using a separate MSR bitmap to run L2. If AVIC\nis fully enabled prior to running L2, and is then inhibited while L2 is\nactive (for a VM-scoped inhibit), then KVM will run L1 with AVIC disabled,\nbut with x2APIC MSR intercepts disabled, i.e. will allow L1 to read most of\nthe host's APIC state, send arbitrary interrupts, change task priority, and\nultimately trivially DoS the host.\n\nE.g. sending a self-IPI in L1 on HYPERV_REENLIGHTENMENT_VECTOR, 0xee, with\nCONFIG_HYPERV=n in the host kernel as a \"safe\" PoC, yields:\n\n Spurious interrupt (vector 0xee) on CPU#425. Acked\n\nAnd hacking KVM to abuse kvm_set_posted_intr_wakeup_handler() to register a\nhandler and WARN on POSTED_INTR_WAKEUP_VECTOR yields:\n\n ------------[ cut here ]------------\n WARNING: arch/x86/kvm/svm/svm.c:5594 at pi_wakeup_handler+0x9/0x10 [kvm_amd], CPU#156: nested_x2apic_t/316940\n CPU: 156 UID: 0 PID: 316940 Comm: nested_x2apic_t Tainted: G S U\n Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER\n Hardware name: Google Astoria-Turin/astoria, BIOS 0.20260209.0-0 02/09/2026\n RIP: 0010:pi_wakeup_handler+0x9/0x10 [kvm_amd]\n Call Trace:\n <IRQ>\n sysvec_kvm_posted_intr_wakeup_ipi+0x64/0x80\n </IRQ>\n <TASK>\n asm_sysvec_kvm_posted_intr_wakeup_ipi+0x1a/0x20\n RIP: 0010:vcpu_run+0x1430/0x1e40 [kvm]\n kvm_arch_vcpu_ioctl_run+0x2c1/0x600 [kvm]\n kvm_vcpu_ioctl+0x580/0x6b0 [kvm]\n __se_sys_ioctl+0x6d/0xb0\n do_syscall_64+0x10a/0x480\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x46ff4b\n </TASK>\n ---[ end trace 0000000000000000 ]---"}], "id": "CVE-2026-74516", "lastModified": "2026-08-15T13:17:56.737", "metrics": {}, "published": "2026-08-15T13:17:56.737", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6664a5aea45318f4ec156a729949b474dd6e3159"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7668c58dcf465559dc7a0d2e95e9cb79cf47454b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7d3aae206663c4e006b25a1c7a20a4029e67da76"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/89f9e8398e79c49886766fc24a84c37726231104"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f12373625b4dc9bcc89c41872648878c73bb9272"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{}