CVE-2026-64604: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode

CVE-2026-64604: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode

When updating CR8 intercepts, get vmcs12 if and only if the vCPU is in
guest mode so that a future change can have update CR8 intercepts during
vCPU creation, without running afoul of get_vmcs12()'s lockdep assertion.

  ------------[ cut here ]------------
  debug_locks && !(lock_is_held(&(&vcpu->mutex)->dep_map) || !refcount_read(&vcpu->kvm->users_count))
  WARNING: arch/x86/kvm/vmx/nested.h:61 at get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline], CPU#0: syz.2.19/5879
  WARNING: arch/x86/kvm/vmx/nested.h:61 at vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879, CPU#0: syz.2.19/5879
  Modules linked in:
  CPU: 0 UID: 0 PID: 5879 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full)
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
  RIP: 0010:get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline]
  RIP: 0010:vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879
  Call Trace:
   <TASK>
   apic_update_ppr arch/x86/kvm/lapic.c:984 [inline]
   kvm_lapic_reset+0x1c24/0x2980 arch/x86/kvm/lapic.c:3023
   kvm_vcpu_reset+0x44c/0x1bf0 arch/x86/kvm/x86.c:12986
   kvm_arch_vcpu_create+0x746/0x8b0 arch/x86/kvm/x86.c:12847
   kvm_vm_ioctl_create_vcpu+0x428/0x930 virt/kvm/kvm_main.c:4201
   kvm_vm_ioctl+0x893/0xd50 virt/kvm/kvm_main.c:5159
   vfs_ioctl fs/ioctl.c:51 [inline]
   __do_sys_ioctl fs/ioctl.c:597 [inline]
   __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
   do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
   </TASK>

No functional change intended.

The Linux kernel CVE team has assigned CVE-2026-64604 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.10.261 with commit c7cd3605244c924249dea32632e1bc3e89bda543
	Fixed in 5.15.212 with commit 9a21f1defd96c6301c5fb462a78eb51b191bd2dd
	Fixed in 6.1.178 with commit 570af5db081b87374594a00711ac5760d2ea6844
	Fixed in 6.6.145 with commit ffaaff82336db84e9b58e7a3e81c2fd64e05ed7a
	Fixed in 6.12.96 with commit 258ec63c0f281bf7b50f9de67c8e93b5b7be5ed4
	Fixed in 6.18.39 with commit 3dcfb04dd43b16fa1240fc6487fff578ad57264c
	Fixed in 7.1.4 with commit db8407b9fd06d857a4a5e8bcff1d086d13007711
	Fixed in 7.2-rc1 with commit 7ef78d71ca713d8c00f7c34ddcf276c808143f77

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64604
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/x86/kvm/vmx/vmx.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c7cd3605244c924249dea32632e1bc3e89bda543
	https://git.kernel.org/stable/c/9a21f1defd96c6301c5fb462a78eb51b191bd2dd
	https://git.kernel.org/stable/c/570af5db081b87374594a00711ac5760d2ea6844
	https://git.kernel.org/stable/c/ffaaff82336db84e9b58e7a3e81c2fd64e05ed7a
	https://git.kernel.org/stable/c/258ec63c0f281bf7b50f9de67c8e93b5b7be5ed4
	https://git.kernel.org/stable/c/3dcfb04dd43b16fa1240fc6487fff578ad57264c
	https://git.kernel.org/stable/c/db8407b9fd06d857a4a5e8bcff1d086d13007711
	https://git.kernel.org/stable/c/7ef78d71ca713d8c00f7c34ddcf276c808143f77