Executive brief
A vulnerability in the Linux kernel's virtualization component (KVM) for AMD processors could allow a local user to trigger a kernel warning. This occurs when a virtual machine's state is restored in a specific sequence, causing the system to report a non-fatal error. While this does not lead to a full system crash or data theft, it can clutter system logs and indicates a minor flaw in how the kernel handles virtual machine configurations.
Technical details
A vulnerability in `arch/x86/kvm/svm/nested.c` within the Linux kernel's KVM implementation for AMD (nSVM) allowed userspace to trigger a `WARN_ON_ONCE` during `svm_set_nested_state()`. The issue stems from `nested_svm_load_cr3()` failing when userspace modifies CPUID properties (specifically `MAX_PHY_ADDR`) after loading CR3, creating an 'illegal' state that KVM's ABI technically permits. An attacker with access to the KVM ioctl interface can trigger this warning by providing a specific sequence of `KVM_SET_CPUID2` and `KVM_SET_NESTED_STATE` calls. The fix involves removing the `WARN_ON_ONCE` macro, as the condition does not represent a critical kernel failure but rather a permissible (if unusual) userspace configuration.
Affected products
- Linux Linux kernel 6.18.0-rc7; 6.1.y; 6.6.y; 6.10.y; 6.11.y; 6.12.y; 6.13.y
Timeline
- 2025-12-16: patched: Initial patch authored by Sean Christopherson
- 2026-05-08: advisory: CVE-2026-43315 published
References
- https://git.kernel.org/stable/c/155ec243ef726f4bc49536fa0bfb565dc011ab17
- https://git.kernel.org/stable/c/580ea57840864d40e019bc13fd26afdc8d510a2f
- https://git.kernel.org/stable/c/969e5e13ff5c18603f21d1f9f64ec9194e141ac0
- https://git.kernel.org/stable/c/ce904c8a5bbe697eae0f7e34b07095bd7a6dee19
- https://git.kernel.org/stable/c/deb8f6dfd31d94b18dbeeaa8c01fbec5fc70fd2b
- https://git.kernel.org/stable/c/ebb2ab4f1c87d6b52776292cf7dc16aea48e95f8
- https://git.kernel.org/stable/c/fc3ba56385d03501eb582e4b86691ba378e556f9