{"id":7514,"date":"2026-09-04T18:49:35","date_gmt":"2026-09-04T10:49:35","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74516"},"modified":"2026-09-04T18:49:35","modified_gmt":"2026-09-04T10:49:35","slug":"cve-2026-74516","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74516","title":{"rendered":"CVE-2026-74516 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Update x2AP"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active<\/p>\n<p>Always update x2APIC MSR intercepts for L1 when AVIC is deactivated, even<br \/>\nif L2 is active and KVM is using a separate MSR bitmap to run L2.  If AVIC<br \/>\nis fully enabled prior to running L2, and is then inhibited while L2 is<br \/>\nactive (for a VM-scoped inhibit), then KVM will run L1 with AVIC disabled,<br \/>\nbut with x2APIC MSR intercepts disabled, i.e. will allow L1 to read most of<br \/>\nthe host&#8217;s APIC state, send arbitrary interrupts, change task priority, and<br \/>\nultimately trivially DoS the host.<\/p>\n<p>E.g. sending a self-IPI in L1 on HYPERV_REENLIGHTENMENT_VECTOR, 0xee, with<br \/>\nCONFIG_HYPERV=n in the host kernel as a &#8220;safe&#8221; PoC, yields:<\/p>\n<p>  Spurious interrupt (vector 0xee) on CPU#425. Acked<\/p>\n<p>And hacking KVM to abuse kvm_set_posted_intr_wakeup_handler() to register a<br \/>\nhandler and WARN on POSTED_INTR_WAKEUP_VECTOR yields:<\/p>\n<p>  &#8212;&#8212;&#8212;&#8212;[ cut here ]&#8212;&#8212;&#8212;&#8212;<br \/>\n  WARNING: arch\/x86\/kvm\/svm\/svm.c:5594 at pi_wakeup_handler+0x9\/0x10 [kvm_amd], CPU#156: nested_x2apic_t\/316940<br \/>\n  CPU: 156 UID: 0 PID: 316940 Comm: nested_x2apic_t Tainted: G S   U<br \/>\n  Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER<br \/>\n  Hardware name: Google Astoria-Turin\/astoria, BIOS 0.20260209.0-0 02\/09\/2026<br \/>\n  RIP: 0010:pi_wakeup_handler+0x9\/0x10 [kvm_amd]<br \/>\n  Call Trace:<\/p>\n<p>   sysvec_kvm_posted_intr_wakeup_ipi+0x64\/0x80<\/p>\n<p>   asm_sysvec_kvm_posted_intr_wakeup_ipi+0x1a\/0x20<br \/>\n  RIP: 0010:vcpu_run+0x1430\/0x1e40 [kvm]<br \/>\n   kvm_arch_vcpu_ioctl_run+0x2c1\/0x600 [kvm]<br \/>\n   kvm_vcpu_ioctl+0x580\/0x6b0 [kvm]<br \/>\n   __se_sys_ioctl+0x6d\/0xb0<br \/>\n   do_syscall_64+0x10a\/0x480<br \/>\n   entry_SYSCALL_64_after_hwframe+0x4b\/0x53<br \/>\n  RIP: 0033:0x46ff4b<\/p>\n<p>  &#8212;[ end trace 0000000000000000 ]&#8212;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active<\/p>\n<p>Always update x2APIC MSR intercepts for L1 when AVI<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7514","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7514","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7514"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7514"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7514"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}