Executive brief
The Linux kernel's KVM virtualization subsystem has a flaw in how it manages ASID (Address Space ID) allocations when physical CPUs undergo hotplug cycles (offline/online transitions). This can cause virtual machines to incorrectly share TLB (translation lookaside buffer) cache entries, leading to memory access errors and potential VM crashes when the kernel attempts operations on stale cached memory translations.
Technical details
The vulnerability exists in the KVM SVM module's ASID allocation logic. When svm_enable_virtualization_cpu() processes a CPU online event (including hotplug cycles), it resets asid_generation to 1, which causes the ASID pool to wrap and reassign IDs that may still be in use by vCPUs that were scheduled out before the hotplug. If a vCPU resumes on the same physical CPU after hotplug, it may retain a stale ASID that has since been reassigned to a different VM's vCPU. This causes both vCPUs to share NPT TLB entries, resulting in incorrect memory translations. The fix increments asid_generation instead of resetting it, ensuring that vCPUs always receive new ASIDs after CPU hotplug cycles. The patch is included in the kernel and requires a rebuild and reboot to apply.
Affected products
- Linux Linux kernel affected versions prior to patch
Timeline
- 2026-08-10: disclosed