Executive brief
A vulnerability in the Linux kernel's virtualization component (KVM) could allow a local user or guest virtual machine to cause the entire host system to crash. The issue occurs when the system incorrectly handles processor state features that should be disabled, leading to a kernel panic. This impacts the availability of the host server and all other virtual machines running on it.
Technical details
A vulnerability exists in the Linux kernel's x86 FPU management when handling guest XSAVE states via KVM. When loading guest state via KVM_SET_XSAVE or updating the eXtended Feature Disable (XFD) register, the kernel may fail to clear bits in XSTATE_BV for features that are currently disabled via XFD. If a host interrupt or preemption occurs while the guest XFD is out of sync with the saved XSTATE_BV, a subsequent XRSTOR instruction will trigger a Device Not Available (#NM) exception in host context, resulting in a kernel panic. This can be triggered by a guest executing WRMSR to set XFD or by userspace providing inconsistent state via KVM_SET_XSAVE. Patches have been released for various stable kernel branches to ensure XSTATE_BV is cleared whenever XFD bits are set.
Affected products
- Linux Linux Kernel 6.19-rc2
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2022-01-14: other: Vulnerability introduced in commit 820a6ee944e7
- 2025-12-31: patched: Initial fix authored by Sean Christopherson
- 2026-01-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1e2848bda819af569dfe7ab186223855e092a2cb
- https://git.kernel.org/stable/c/b45f721775947a84996deb5c661602254ce25ce6
- https://git.kernel.org/stable/c/b5995c01ba53d84182ecb9492fc4d91cfe8a362d
- https://git.kernel.org/stable/c/eea6f395ca502c4528314c8112da9b5d65f685eb
- https://git.kernel.org/stable/c/f577508cc8a0adb8b4ebe9480bba7683b6149930
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html