Executive brief
A flaw was discovered in the Linux kernel's virtualization component (KVM) for AMD processors. When running virtual machines, the system could fail to correctly manage how the guest operating system interacts with certain processor controls. This can lead to significant performance degradation or, in the case of Windows virtual machines, a complete system crash (Blue Screen of Death) because the virtual processor's internal state becomes out of sync with the physical hardware.
Technical details
A vulnerability in the Linux kernel's KVM SVM implementation occurs because the hypervisor does not explicitly set or clear CR8 write interceptions during AVIC (de)activation. Specifically, if KVM emulates certain states (like INIT=>WFS) while AVIC is deactivated, the CR8 intercept may remain enabled indefinitely after AVIC is reactivated. While primarily a performance issue, when combined with existing TPR synchronization bugs, it causes the Task Priority Register (TPR) seen by hardware to diverge from the software state. This is particularly fatal for Windows guests, leading to guest crashes. The fix ensures that `INTERCEPT_CR8_WRITE` is explicitly cleared when AVIC is activated and restored when deactivated.
Affected products
- Linux Linux Kernel SVM-based systems (AMD) using AVIC
Timeline
- 2026-03-16: patched: Initial patch by Sean Christopherson
- 2026-05-13: disclosed: CVE-2026-43483 published
References
- https://git.kernel.org/stable/c/01651e7751edbbc0fb4598f8367a3dabcfc8c182
- https://git.kernel.org/stable/c/737410b32bd615b321da4fbeda490351b9af5e8b
- https://git.kernel.org/stable/c/816fa1dfae4532e851b1fe6b2434c753ecbd86c7
- https://git.kernel.org/stable/c/87d0f901a9bd8ae6be57249c737f20ac0cace93d
- https://git.kernel.org/stable/c/a4123fe5d9122eef9852e4921f7cc463420f30d4
- https://git.kernel.org/stable/c/ba3bca40f9f25c053f69413e5f4a41dd0fd762bf