Description
In the Linux kernel, the following vulnerability has been resolved:
KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT
If loading L1's CR3 fails on a nested #VMEXIT, nested_svm_vmexit()
returns an error code that is ignored by most callers, and continues to
run L1 with corrupted state. A sane recovery is not possible in this
case, and HW behavior is to cause a shutdown. Inject a triple fault
instead, and do not return early from nested_svm_vmexit(). Continue
cleaning up the vCPU state (e.g. clear pending exceptions), to handle
the failure as gracefully as possible.
From the APM:
Upon #VMEXIT, the processor performs the following actions in order to
return to the host execution context:
...
if (illegal host state loaded, or exception while loading host state)
shutdown
else
execute first host instruction following the VMRUN
Remove the return value of nested_svm_vmexit(), which is mostly
unchecked anyway.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 5.9 | 6.1.191 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 7.0.4-1 | — |
| Debian 13 | linux | 6.12.115-2 | — |
| Debian 12 | linux | No fix yet | — |
| Debian 12 | linux-6.12 | 6.12.115-2~deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 24.04 LTS | linux-bluefield | No fix yet | — |
| Ubuntu Nvidia-BlueField 22.04 LTS | linux-bluefield | No fix yet | — |
| Ubuntu 26.04 LTS | linux | 7.0.0-27.27 | USN-8488-1 |
| Ubuntu 26.04 LTS | linux-aws +1 | 7.0.0-1008.8 | USN-8489-1, USN-8488-1 |
| Ubuntu 26.04 LTS | linux-azure | 7.0.0-1010.10 | USN-8603-1 |
| Ubuntu 26.04 LTS | linux-gcp +1 | 7.0.0-1007.7 | USN-8488-1 |
| Ubuntu 26.04 LTS | linux-ibm +1 | 7.0.0-1009.9 | USN-8603-1, USN-8488-1 |
| Ubuntu 26.04 LTS | linux-nvidia | 7.0.0-1013.13 | USN-8507-1 |
| Ubuntu 26.04 LTS | linux-raspi | 7.0.0-1014.14 | USN-8488-2 |
| Ubuntu 26.04 LTS | linux-riscv +1 | 7.0.0-27.27.1 | USN-8488-1 |
| Ubuntu 25.10 | linux +8 | No fix yet | — |
| Ubuntu 24.04 LTS | linux +44 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-hwe-7.0 | 7.0.0-28.28~24.04.1 | USN-8569-1 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | linux +59 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime +3 | No fix yet | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime +2 | No fix yet | — |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-preview 22.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | linux-aws-5.15 +10 | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kernel-source | 7.0.11-1.1 | openSUSE-SU-2026:10954-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kernel | No fix yet | — |
Advisories 8
- WID-SEC-2026-1700 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- USN-8603-1 linux-azure, linux-azure-fde vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8488-1 linux, linux-aws, linux-gcp, linux-ibm, linux-oracle, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8569-1 linux-hwe-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8488-2 linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8489-1 linux-oem-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8507-1 linux-nvidia vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- openSUSE-SU-2026:10954-1 kernel-devel-7.0.11-1.1 on GA media SUSE / openSUSE Security Updates · Jun 5, 2026
References
- https://git.kernel.org/stable/c/e6318570a9b4e137b0b744832b920b38bb069561
- https://git.kernel.org/stable/c/2e661773890e6ba6b16064fad961da3dd311be43
- https://git.kernel.org/stable/c/af79992ecdb6817970d757fb5d853b8d9b55a0d6
- https://git.kernel.org/stable/c/b0eb0a8959ac2b808eb11548d002fe1f9b5650cc
- https://git.kernel.org/stable/c/9a738cf170a4a2332ea3a15e23ec65b5757fe4a1
- https://git.kernel.org/stable/c/5d291ef0585ed880ed4dd71ea1a5965e0a65fb53