Description
A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State (SEV-ES). A KVM guest using SEV-ES can trigger out-of-bounds reads and writes in the host kernel via a malicious VMGEXIT for a string I/O instruction (for example, outs or ins) using the exit reason SVM_EXIT_IOIO. This issue results in a crash of the entire system or a potential guest-to-host escape scenario.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | kernel | kernel 5.15 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 5.14.16-1 | — |
| Debian 13 | linux | 5.14.16-1 | — |
| Debian 12 | linux | 5.14.16-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | linux-aws-5.11 +1 | 5.11.0-1028.31~20.04.1 | USN-5265-1 |
| Ubuntu 20.04 LTS | linux-aws-5.13 | 5.13.0-1012.13~20.04.1 | USN-5265-1 |
| Ubuntu 20.04 LTS | linux-aws-5.8 +7 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-azure-5.11 | 5.11.0-1028.31~20.04.2 | USN-5265-1 |
| Ubuntu 20.04 LTS | linux-azure-5.13 | 5.13.0-1013.15~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-gcp-5.11 | 5.11.0-1029.33~20.04.3 | USN-5265-1 |
| Ubuntu 20.04 LTS | linux-gcp-5.13 | 5.13.0-1013.16~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-hwe-5.13 | 5.13.0-28.31~20.04.1 | USN-5265-1 |
| Ubuntu 20.04 LTS | linux-oem-5.13 | 5.13.0-1029.36 | USN-5265-1 |
| Ubuntu 20.04 LTS | linux-oem-5.14 | 5.14.0-1008.8 | — |
| Ubuntu 20.04 LTS | linux-oracle-5.13 | 5.13.0-1016.20~20.04.1 | — |
| Ubuntu 18.04 LTS | linux-gcp +12 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | kernel-rt +12 | 4.18.0-372.9.1.rt7.166.el8 | RHSA-2022:1975 |
| RHEL 8 | perf +26 | 4.18.0-372.9.1.el8 | RHSA-2022:1988 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | kernel | 4.18.0-372.9.1.el8 | RLSA-2022:1988 |
Advisories 4
- RHSA-2022:1988 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2022:1975 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- USN-5265-1 linux, linux-aws, linux-aws-5.11, linux-aws-5.13, linux-azure-5.11, linux-gcp, linux-gcp-5.11, linux-hwe-5.13, linux-kvm, linux-oem-5.13, linux-oracle, linux-oracle-5.11, linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Sep 10, 2026
- RLSA-2022:1988 Important: kernel security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026