Executive brief
A vulnerability was identified in the Linux kernel's virtualization component (KVM) specifically affecting AMD systems using nested virtualization. Under certain configurations involving Hyper-V features, a guest operating system could execute hypercalls that should have been restricted or handled differently by the host. This could lead to unexpected behavior or instability within the virtualized environment, though it is primarily addressed to ensure architectural correctness and prevent unauthorized hypercall execution.
Technical details
A vulnerability in the Linux kernel's KVM nSVM (Nested Secure Virtual Machine) implementation occurred when L2 is active and nested_svm_l2_tlb_flush_enabled() is true. If the L1 hypervisor does not intercept VMMCALL, KVM would intercept the call but fail to forward it to L1, effectively allowing the L2 guest to make hypercalls directly to L0 as if it were L1. The fix ensures that KVM explicitly synthesizes an undefined instruction (#UD) exception for VMMCALLs that are not supported Hyper-V hypercalls in this specific nested state, adhering to architectural expectations. The issue was resolved by updating the SVM exit handlers to include a new vmmcall_interception routine that validates the guest mode and hypercall type before emulation.
Affected products
- Linux Linux Kernel 6.1, 6.6, 6.8, 6.9
Timeline
- 2026-03-03: other: Patch authored
- 2026-05-07: patched: Patch committed to stable tree
- 2026-05-27: disclosed: CVE published