# CVE-2026-99258: Linux kernel x86 Hyper-V memory access violation

Source: https://junglewise.ai/threats/cve-2026-99258-in-the-linux-kernel-the-following-vulnerability-has-been-resolved  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-99258 · Severity: info · Published 2026-11-03

The Linux kernel's x86 Hyper-V support contains a memory access vulnerability in the hv_apicid_to_vp_index() function when running as a guest in certain virtualization scenarios. When running in SEV-SNP confidential compute mode without a paravisor, the Hyper-V hypervisor writes output data to memory that the guest has not allocated, potentially causing memory corruption or system instability.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-2026-99258 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-99258 being exploited in the wild.

**How severe is CVE-2026-99258?** Informational severity, published 3 November 2026.

**Which products and versions are affected?** Linux Kernel before fix commit 7b74c117e2aac78e0f723e1c9c3644451c56b0d9.

**Is there a fix for CVE-2026-99258?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-99258 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-99258?** Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The hv_apicid_to_vp_index() function uses separate per-cpu input and output pages for Hyper-V hypercalls. In SEV-SNP confidential compute VMs without a paravisor, the output page is not allocated by the guest, causing the hypervisor to write the VP index result to unallocated memory. The fix redirects the output to use the input page, since the hypercall's input and output are both small enough to coexist on a single page.

## Affected products

- Linux kernel before fix commit 7b74c117e2aac78e0f723e1c9c3644451c56b0d9

## Timeline

- 2026-11-03: disclosed

## References

- [https://git.kernel.org/stable/c/2b561786c9076a892ef8b8f416c9828bc87ed44f](https://git.kernel.org/stable/c/2b561786c9076a892ef8b8f416c9828bc87ed44f)
- [https://git.kernel.org/stable/c/7b74c117e2aac78e0f723e1c9c3644451c56b0d9](https://git.kernel.org/stable/c/7b74c117e2aac78e0f723e1c9c3644451c56b0d9)

## Related threats

- [Linux kernel xen-netback double unmap memory corruption](https://junglewise.ai/threats/cve-2026-99287-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel PMC uninitialized clock rate in 32-bit Tegra](https://junglewise.ai/threats/cve-2026-99259-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel io_uring signal loss in worker exit](https://junglewise.ai/threats/cve-2026-99228-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel mv643xx_eth NULL pointer dereference in PHY probe](https://junglewise.ai/threats/cve-2026-99197-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel unicode map use-after-free in path lookup](https://junglewise.ai/threats/cve-2026-99180-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)