CVE-2026-64172

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64172", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.039Z", "datePublished": "2026-07-19T15:40:57.153Z", "dateUpdated": "2026-08-05T12:39:52.348Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:39:52.348Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)\n\nHygon Family 18h CPUs are derived from AMD Family 17h (Zen1) silicon and\nshare the same erratum #1235: hardware may read a stale IsRunning=1 bit\nduring ICR write emulation and silently fail to generate an\nAVIC_IPI_FAILURE_TARGET_NOT_RUNNING VM-Exit on the sending vCPU.\n\nThe absence of the VM-Exit causes KVM to miss the required wakeup of\nblocking target vCPUs, leading to hung vCPUs and unbounded delays in\nguest execution.\n\nExtend the existing AMD Family 17h erratum #1235 workaround to also cover\nHygon Family 18h. With IPI virtualization disabled, KVM never sets\nIsRunning=1 in the Physical ID table, so every non-self IPI generates a\nVM-Exit and is correctly emulated."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires executing guest code that issues APIC ICR writes against blocking vCPUs; the vulnerable KVM/AVIC path is reached from within a VM, not from remote network packets to the host.\nAC:L - The erratum is a race on IsRunning that the attacker fully controls by pinning one vCPU in a blocking halt/mwait state and having another vCPU send timed IPIs; no conditions outside attacker influence are required once AVIC is active.\nPR:N - No host privileges are needed beyond the ability to run code in a tenant VM on a Hygon KVM host; a cloud customer with a standard VM instance can trigger the bug without host root or special capabilities.\nUI:N - No victim interaction is required; a malicious guest can autonomously orchestrate blocking and IPI traffic to hang vCPUs.\nS:C - In nested virtualization deployments, a malicious L1 hypervisor guest can cause hung vCPUs and unbounded execution delays in L2 guests via the host KVM AVIC path, crossing the L1/L2 security boundary even though there is no host escape.\nC:N - The bug is a missed VM-exit and missed vCPU wakeup with no out-of-bounds access, use-after-free, or information disclosure primitive.\nI:N - No memory or data structures are corrupted; the failure only prevents delivery of required wake events to blocking vCPUs.\nA:H - Missed wakeups cause hung vCPUs and unbounded delays in guest execution, constituting a reliable denial-of-service against VM availability."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/svm/avic.c"], "versions": [{"version": "8de4a1c8164e5b2e40d1df764840a31de983f40b", "lessThan": "94ade38f317ea086a181db0e6b69c574b3b70a5e", "status": "affected", "versionType": "git"}, {"version": "8de4a1c8164e5b2e40d1df764840a31de983f40b", "lessThan": "9560e6fee887a9594a89fa265b5b9c79b1591803", "status": "affected", "versionType": "git"}, {"version": "8de4a1c8164e5b2e40d1df764840a31de983f40b", "lessThan": "9a12fa5213cfc391e0eed63902d3be98f0913765", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/svm/avic.c"], "versions": [{"version": "6.17", "status": "affected"}, {"version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.34", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/94ade38f317ea086a181db0e6b69c574b3b70a5e"}, {"url": "https://git.kernel.org/stable/c/9560e6fee887a9594a89fa265b5b9c79b1591803"}, {"url": "https://git.kernel.org/stable/c/9a12fa5213cfc391e0eed63902d3be98f0913765"}], "title": "KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/x86/kvm/svm/avic.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "94ade38f317ea086a181db0e6b69c574b3b70a5e", "status": "affected", "version": "8de4a1c8164e5b2e40d1df764840a31de983f40b", "versionType": "git"}, {"lessThan": "9560e6fee887a9594a89fa265b5b9c79b1591803", "status": "affected", "version": "8de4a1c8164e5b2e40d1df764840a31de983f40b", "versionType": "git"}, {"lessThan": "9a12fa5213cfc391e0eed63902d3be98f0913765", "status": "affected", "version": "8de4a1c8164e5b2e40d1df764840a31de983f40b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/x86/kvm/svm/avic.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"lessThan": "6.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.34", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C3CE5A34-10BF-4E70-9714-5014369FC0B0", "versionEndExcluding": "6.18.34", "versionStartIncluding": "6.17", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750", "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)\n\nHygon Family 18h CPUs are derived from AMD Family 17h (Zen1) silicon and\nshare the same erratum #1235: hardware may read a stale IsRunning=1 bit\nduring ICR write emulation and silently fail to generate an\nAVIC_IPI_FAILURE_TARGET_NOT_RUNNING VM-Exit on the sending vCPU.\n\nThe absence of the VM-Exit causes KVM to miss the required wakeup of\nblocking target vCPUs, leading to hung vCPUs and unbounded delays in\nguest execution.\n\nExtend the existing AMD Family 17h erratum #1235 workaround to also cover\nHygon Family 18h. With IPI virtualization disabled, KVM never sets\nIsRunning=1 in the Physical ID table, so every non-self IPI generates a\nVM-Exit and is correctly emulated."}], "id": "CVE-2026-64172", "lastModified": "2026-08-13T15:32:19.817", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 4.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-19T16:17:59.383", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/94ade38f317ea086a181db0e6b69c574b3b70a5e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9560e6fee887a9594a89fa265b5b9c79b1591803"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9a12fa5213cfc391e0eed63902d3be98f0913765"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)", "id": "2502578", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502578"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem, specifically affecting Hygon Family 18h processors. Due to an erratum, the hardware may incorrectly read a stale status bit during interrupt processing, preventing the virtual machine from exiting as expected. This issue can cause KVM to miss critical wakeup signals for virtual CPUs, leading to guest virtual machines becoming unresponsive and experiencing unbounded delays, effectively resulting in a denial of service."], "name": "CVE-2026-64172", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64172\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64172\nhttps://lore.kernel.org/linux-cve-announce/2026071936-CVE-2026-64172-c960@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8de4a1c8164e5b2e40d1df764840a31de983f40b,94ade38f317ea086a181db0e6b69c574b3b70a5e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8de4a1c8164e5b2e40d1df764840a31de983f40b,9560e6fee887a9594a89fa265b5b9c79b1591803)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8de4a1c8164e5b2e40d1df764840a31de983f40b,9a12fa5213cfc391e0eed63902d3be98f0913765)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.34,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.11,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T16:45:02.890136+00:00", "updated": "2026-08-13T18:15:04.822658+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}