{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64172","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T07:54:57.039Z","datePublished":"2026-07-19T15:40:57.153Z","dateUpdated":"2026-08-05T12:39:52.348Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:39:52.348Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)\n\nHygon Family 18h CPUs are derived from AMD Family 17h (Zen1) silicon and\nshare the same erratum #1235: hardware may read a stale IsRunning=1 bit\nduring ICR write emulation and silently fail to generate an\nAVIC_IPI_FAILURE_TARGET_NOT_RUNNING VM-Exit on the sending vCPU.\n\nThe absence of the VM-Exit causes KVM to miss the required wakeup of\nblocking target vCPUs, leading to hung vCPUs and unbounded delays in\nguest execution.\n\nExtend the existing AMD Family 17h erratum #1235 workaround to also cover\nHygon Family 18h.  With IPI virtualization disabled, KVM never sets\nIsRunning=1 in the Physical ID table, so every non-self IPI generates a\nVM-Exit and is correctly emulated."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires executing guest code that issues APIC ICR writes against blocking vCPUs; the vulnerable KVM/AVIC path is reached from within a VM, not from remote network packets to the host.\nAC:L - The erratum is a race on IsRunning that the attacker fully controls by pinning one vCPU in a blocking halt/mwait state and having another vCPU send timed IPIs; no conditions outside attacker influence are required once AVIC is active.\nPR:N - No host privileges are needed beyond the ability to run code in a tenant VM on a Hygon KVM host; a cloud customer with a standard VM instance can trigger the bug without host root or special capabilities.\nUI:N - No victim interaction is required; a malicious guest can autonomously orchestrate blocking and IPI traffic to hang vCPUs.\nS:C - In nested virtualization deployments, a malicious L1 hypervisor guest can cause hung vCPUs and unbounded execution delays in L2 guests via the host KVM AVIC path, crossing the L1/L2 security boundary even though there is no host escape.\nC:N - The bug is a missed VM-exit and missed vCPU wakeup with no out-of-bounds access, use-after-free, or information disclosure primitive.\nI:N - No memory or data structures are corrupted; the failure only prevents delivery of required wake events to blocking vCPUs.\nA:H - Missed wakeups cause hung vCPUs and unbounded delays in guest execution, constituting a reliable denial-of-service against VM availability."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/x86/kvm/svm/avic.c"],"versions":[{"version":"8de4a1c8164e5b2e40d1df764840a31de983f40b","lessThan":"94ade38f317ea086a181db0e6b69c574b3b70a5e","status":"affected","versionType":"git"},{"version":"8de4a1c8164e5b2e40d1df764840a31de983f40b","lessThan":"9560e6fee887a9594a89fa265b5b9c79b1591803","status":"affected","versionType":"git"},{"version":"8de4a1c8164e5b2e40d1df764840a31de983f40b","lessThan":"9a12fa5213cfc391e0eed63902d3be98f0913765","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/x86/kvm/svm/avic.c"],"versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","status":"unaffected","versionType":"semver"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17","versionEndExcluding":"6.18.34"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17","versionEndExcluding":"7.0.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17","versionEndExcluding":"7.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/94ade38f317ea086a181db0e6b69c574b3b70a5e"},{"url":"https://git.kernel.org/stable/c/9560e6fee887a9594a89fa265b5b9c79b1591803"},{"url":"https://git.kernel.org/stable/c/9a12fa5213cfc391e0eed63902d3be98f0913765"}],"title":"KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)","x_generator":{"engine":"bippy-1.2.0"}}}}