CVE-2026-43265 (GCVE-0-2026-43265)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:21
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() Ignore -EBUSY when checking nested events after exiting a blocking state while L2 is active, as exiting to userspace will generate a spurious userspace exit, usually with KVM_EXIT_UNKNOWN, and likely lead to the VM's demise. Continuing with the wakeup isn't perfect either, as *something* has gone sideways if a vCPU is awakened in L2 with an injected event (or worse, a nested run pending), but continuing on gives the VM a decent chance of surviving without any major side effects. As explained in the Fixes commits, it _should_ be impossible for a vCPU to be put into a blocking state with an already-injected event (exception, IRQ, or NMI). Unfortunately, userspace can stuff MP_STATE and/or injected events, and thus put the vCPU into what should be an impossible state. Don't bother trying to preserve the WARN, e.g. with an anti-syzkaller Kconfig, as WARNs can (hopefully) be added in paths where _KVM_ would be violating x86 architecture, e.g. by WARNing if KVM attempts to inject an exception or interrupt while the vCPU isn't running.
References
Impacted products
Vendor Product Version
Linux Linux Version: 26844fee6adee9b1557d2279b0506285de9ee82b
Version: 26844fee6adee9b1557d2279b0506285de9ee82b
Version: 26844fee6adee9b1557d2279b0506285de9ee82b
Version: 26844fee6adee9b1557d2279b0506285de9ee82b
Version: 26844fee6adee9b1557d2279b0506285de9ee82b
Version: 26844fee6adee9b1557d2279b0506285de9ee82b
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/x86.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "78265cd066d73a5cb41c088fcae4a2515e480d97",
              "status": "affected",
              "version": "26844fee6adee9b1557d2279b0506285de9ee82b",
              "versionType": "git"
            },
            {
              "lessThan": "ec3be7dc9391085a2d96700e159d66d1328b7ff6",
              "status": "affected",
              "version": "26844fee6adee9b1557d2279b0506285de9ee82b",
              "versionType": "git"
            },
            {
              "lessThan": "2657439265d34a911886b916ba8be97ecc117d51",
              "status": "affected",
              "version": "26844fee6adee9b1557d2279b0506285de9ee82b",
              "versionType": "git"
            },
            {
              "lessThan": "1e88b5f854bdb469424132e0bb44793ad7a7c20a",
              "status": "affected",
              "version": "26844fee6adee9b1557d2279b0506285de9ee82b",
              "versionType": "git"
            },
            {
              "lessThan": "1c957773063ed3264953597e32990a748381caf6",
              "status": "affected",
              "version": "26844fee6adee9b1557d2279b0506285de9ee82b",
              "versionType": "git"
            },
            {
              "lessThan": "ead63640d4e72e6f6d464f4e31f7fecb79af8869",
              "status": "affected",
              "version": "26844fee6adee9b1557d2279b0506285de9ee82b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/x86.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.17",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()\n\nIgnore -EBUSY when checking nested events after exiting a blocking state\nwhile L2 is active, as exiting to userspace will generate a spurious\nuserspace exit, usually with KVM_EXIT_UNKNOWN, and likely lead to the VM\u0027s\ndemise.  Continuing with the wakeup isn\u0027t perfect either, as *something*\nhas gone sideways if a vCPU is awakened in L2 with an injected event (or\nworse, a nested run pending), but continuing on gives the VM a decent\nchance of surviving without any major side effects.\n\nAs explained in the Fixes commits, it _should_ be impossible for a vCPU to\nbe put into a blocking state with an already-injected event (exception,\nIRQ, or NMI).  Unfortunately, userspace can stuff MP_STATE and/or injected\nevents, and thus put the vCPU into what should be an impossible state.\n\nDon\u0027t bother trying to preserve the WARN, e.g. with an anti-syzkaller\nKconfig, as WARNs can (hopefully) be added in paths where _KVM_ would be\nviolating x86 architecture, e.g. by WARNing if KVM attempts to inject an\nexception or interrupt while the vCPU isn\u0027t running."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:21:13.005Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/78265cd066d73a5cb41c088fcae4a2515e480d97"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec3be7dc9391085a2d96700e159d66d1328b7ff6"
        },
        {
          "url": "https://git.kernel.org/stable/c/2657439265d34a911886b916ba8be97ecc117d51"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e88b5f854bdb469424132e0bb44793ad7a7c20a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c957773063ed3264953597e32990a748381caf6"
        },
        {
          "url": "https://git.kernel.org/stable/c/ead63640d4e72e6f6d464f4e31f7fecb79af8869"
        }
      ],
      "title": "KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43265",
    "datePublished": "2026-05-06T11:28:51.552Z",
    "dateReserved": "2026-05-01T14:12:55.997Z",
    "dateUpdated": "2026-05-11T22:21:13.005Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.