Executive brief
A vulnerability was identified in the Linux kernel's virtualization component (KVM) for AMD processors. This issue occurs when a virtual machine is running another virtual machine (nested virtualization) and certain processor features are disabled. If a virtual machine's state is saved and then restored, the system might use an incorrect memory address for the next instruction, potentially leading to unstable behavior or unexpected execution flow within the virtual environment.
Technical details
A logic error exists in the Linux kernel's KVM nSVM (Nested Secure Virtual Machine) implementation. For guests with NextRIP Saving (NRIPS) disabled, KVM emulates the behavior by using the current RIP as the NextRIP in the vmcb02 control block. However, after the initial L2 VMRUN, the NextRIP is updated by the hardware or KVM, making the original RIP value stale. If a save/restore (migration) occurs, KVM would incorrectly revert to using the L2 RIP from vmcb12 even if a nested run was not pending. The fix ensures that the current RIP is used only if a nested run is pending; otherwise, the updated NextRIP is preserved. This affects the stability and correctness of instruction pointer tracking during nested soft interrupt injection.
Affected products
- Linux Linux Kernel KVM nSVM component
Timeline
- 2026-02-25: other: Patch authored
- 2026-05-27: disclosed: CVE published