Description
In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux kernel 4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD processors but Intel CPUs cannot be ruled out.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| linux | linux_kernel | 4.10 to 5.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 5.4.19-1 | — |
| Debian 13 | linux | 5.4.19-1 | — |
| Debian 12 | linux | 5.4.19-1 | — |
| Debian 10 | linux | 4.19.118-2+deb10u1 | DSA-4699-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | linux-raspi-realtime | No fix yet | — |
| Ubuntu 22.04 LTS | linux-riscv +2 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +5 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-aws-5.0 | 5.0.0-1027.30 | USN-4301-1 |
| Ubuntu 18.04 LTS | linux-azure | 5.0.0-1035.37 | USN-4301-1 |
| Ubuntu 18.04 LTS | linux-azure-5.3 | 5.3.0-1016.17~18.04.1 | USN-4300-1 |
| Ubuntu 18.04 LTS | linux-gcp | 5.0.0-1033.34 | USN-4301-1 |
| Ubuntu 18.04 LTS | linux-gcp-5.3 +1 | 5.3.0-1014.15~18.04.1 | USN-4300-1 |
| Ubuntu 18.04 LTS | linux-gcp-edge +2 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gke-5.0 | 5.0.0-1032.33 | USN-4301-1 |
| Ubuntu 18.04 LTS | linux-hwe | 5.3.0-42.34~18.04.1 | USN-4300-1 |
| Ubuntu 18.04 LTS | linux-oem-osp1 | 5.0.0-1043.48 | USN-4301-1 |
| Ubuntu 18.04 LTS | linux-oracle-5.0 | 5.0.0-1013.18 | USN-4301-1 |
| Ubuntu 18.04 LTS | linux-raspi2-5.3 | 5.3.0-1019.21~18.04.1 | USN-4300-1 |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | linux | 4.15.0-96.97 | LSN-0065-1 |
| Ubuntu Pro 18.04 LTS | linux-azure | 5.0.0-1036.38 | LSN-0065-1 |
| Ubuntu Pro 18.04 LTS | linux-gcp | 5.0.0-1034.35 | LSN-0065-1 |
| Ubuntu Pro 16.04 LTS | linux | 4.4.0-177.207 | LSN-0065-1 |
| Ubuntu Pro 16.04 LTS | linux-aws | 4.4.0-1105.116 | LSN-0065-1 |
| Ubuntu Pro 16.04 LTS | linux-azure | 4.15.0-1077.82 | LSN-0065-1 |
| Ubuntu Pro 16.04 LTS | linux-hwe | 4.15.0-96.97~16.04.1 | LSN-0065-1 |
| Ubuntu Pro 14.04 LTS | linux-lts-xenial | 4.4.0-177.207~14.04.1 | LSN-0065-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | kernel-rt +12 | 4.18.0-193.13.2.rt13.65.el8_2 | RHSA-2020:3016 |
| RHEL 8 | perf +26 | 4.18.0-193.13.2.el8_2 | RHSA-2020:3010 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kernel-source | 5.14.6-1.4 | openSUSE-SU-2024:13704-1, openSUSE-SU-2024:10728-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | kernel-livepatch-4.14.192-147.314 | 1.0-0.amzn2 | ALAS2-2020-1480 |
| Amazon Linux 2 | perf +8 | 4.14.192-147.314.amzn2 | ALAS2-2020-1480 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kernel | 6.6.29.1-4 | — |
| Azure Linux 2 (CBL-Mariner) | kernel | 5.10.78.1-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | perf +19 | 4.18.0-193.13.2.el8_2 | ELSA-2020-3010 |
| Oracle Linux 7 | perf +10 | 4.14.35-1902.10.4.el7uek | ELSA-2020-5533, ELSA-2020-5528, ELSA-2020-5526 |
Advisories 13
- RHSA-2020:3016 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2020:3010 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- LSN-0065-1 Kernel Live Patch Security Notice Ubuntu Security Notices (USN) · Jun 3, 2026
- USN-4301-1 linux-aws-5.0, linux-gcp, linux-gke-5.0, linux-oracle-5.0, linux-azure vulnerabilities Ubuntu Security Notices (USN) · Jun 3, 2026
- USN-4300-1 linux, linux-aws, linux-gcp, linux-gcp-5.3, linux-gke-5.3, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-raspi2-5.3, linux-azure, linux-azure-5.3 vulnerabilities Ubuntu Security Notices (USN) · Jun 3, 2026
- DSA-4699-1 linux - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:13704-1 kernel-devel-longterm-6.6.17-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10728-1 kernel-devel-5.14.6-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2-2020-1480 Important: kernel security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jun 19, 2024
- ELSA-2020-3010 Important: kernel security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 24, 2020
- ELSA-2020-5533 Important: Unbreakable Enterprise kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 10, 2020
- ELSA-2020-5528 Important: Unbreakable Enterprise kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 30, 2020
- ELSA-2020-5526 Important: Unbreakable Enterprise kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 30, 2020
References
- [oss-security] 20200130 CVE-2019-3016: information leak within a KVM guest mailing-list
- https://lore.kernel.org/lkml/1580407316-11391-1-git-send-email-pbonzini%40redhat.com/
- https://bugzilla.redhat.com/show_bug.cgi?id=1792167
- https://git.kernel.org/linus/8c6de56a42e0c657955e12b882a81ef07d1d073e
- https://git.kernel.org/linus/1eff70a9abd46f175defafd29bc17ad456f398a7
- https://git.kernel.org/linus/917248144db5d7320655dbb41d3af0b8a0f3d589
- https://git.kernel.org/linus/b043138246a41064527cf019a3d51d9f015e9796
- https://git.kernel.org/linus/a6bd811f1209fe1c64c9f6fd578101d6436c6b6e
- https://security.netapp.com/advisory/ntap-20200313-0003/
- USN-4300-1 vendor-advisory
- USN-4301-1 vendor-advisory
- http://packetstormsecurity.com/files/157233/Kernel-Live-Patch-Security-Notice-LSN-0065-1.html
- DSA-4699 vendor-advisory