From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793187631; b=qJ4H0QiXuFB0g77pjdP3HYkN3IBOWWvnab/jq/kWxVKnaZz/chdoaATaSCwWOYvdVy6W NHWEaUoO4/8OCkgZsWq5rFZg815K+Y6uvicoNavEQ4dh6bHRTuRpqg7udw4DVs0BriZdN B1fHknp46c2aafq53xpsg46N49/2zyJBURsyCWuyb77oHAaLjpzzQvJqJNqY4v6qCjyUq qKoTWNcM9dBRh8Xh3km/ObyFzz7g9LdSu3golSNBFLR3YGSlJcY5wPaFx9g9EclVDrBrj qcmjjrSW32gnCN7/1owGT/1OPt0oCNwWb7H+lxFpQt1gAT1T7GlgmKYVXOXDCHzKFSw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793187631; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: Reply-To:MIME-Version:Lines:X-Developer-Signature:X-Developer-Key: Content-Transfer-Encoding; bh=lHnatJKoflXWQmx4YaQBrUBl/YNdp3JOrpOGWh/BJc8=; b=yNoPpcG6XtiMyts9HQyU/9FvafhTvi6065a9+TOFZnCZ9KltyKZxpsmM7vHDPvwmx8Ob I0H4TCSlhEahQJs3eE+aoDWnz6/ox9mxbvjRaAcNFtJuslch+XVQSVhmm88cfNslva9x9 9Qlsuljww2HJyxraKN7Q5GNGxJleEDgfEO/NlOqY9NSHAC0IWYU9yL4YACMm+FucsOKXV MY36oBXhW64FAL1FxBHXu9t+G0ZRNFvJFVGy7O8MopAzSTHNJGI7jWfJOPK2tgs9fVIPD 3XraGFVNQ5FjEfukmmq2Hgkw5Iw7KbXk3Ycq0MozVncqhY29vg/Zxd2hrJdWyD/Xumg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=E2SMJcZX; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A5B81606A31A for ; Wed, 28 Oct 2026 11:40:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=E2SMJcZX Received: by smtp.kernel.org (Postfix) with ESMTPSA id EAE361F01825; Wed, 28 Oct 2026 11:40:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793187630; bh=lHnatJKoflXWQmx4YaQBrUBl/YNdp3JOrpOGWh/BJc8=; h=From:To:Cc:Subject:Date:Reply-To; b=E2SMJcZX/ij4vOCOrwu6025TOvuTH9pTFql7BW0qjLMeNbtcJ3KipNJJBrcKI1T5g H5OZLblrEmkTKh8zVU6SvMoC0RCZAUYWCIGJeKCpaYWghi++B8rnFFmKyO3DVWVJh1 7sSxLNDVxxVn9RqgaTXtiNtGAHC3ng5k8Ua4cUtw= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-99178: x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context Date: Wed, 28 Oct 2026 11:36:05 +0100 Message-ID: <2026102809-CVE-2026-99178-00ac@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4389; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=KiINiSJbytv6aLS8gDEfr81nK8LPC8FCskcu8WQ1WNk=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkPz9/NkY/7OytL+/lXf7Z1nywmfuhPYJcrMfp4/M7DI 88XbL1xqCOWhUGQiUFWTJHlyzaeo/srDil6GdqehpnDygQyhIGLUwAmEvmcYa48l4+2i3mWsYuM 6Kp181wVTj00WsywYMmBC9FyN6p9fHYWnt98/cPSzZP3WwIA X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context An async #PF "page not present" event arrives through the #PF vector, and its reason sits in the per-CPU apf_reason.flags until __kvm_handle_async_pf() reads and clears it. If an NMI arrives after the event is injected and before the #PF handler reads the flags, and the NMI handler itself takes a #PF, that fault reads and clears the flags belonging to the #PF it interrupted. It then finds interrupts disabled in the NMI context it interrupted, and panics: Kernel panic - not syncing: Host injected async #PF in interrupt disabled region Call Trace: panic+0x52/0x60 __kvm_handle_async_pf+0xb0/0xb0 exc_page_fault+0x71/0xb0 asm_exc_page_fault+0x27/0x30 RIP: 0010:__get_user_nocheck_8+0x6/0x20 perf_callchain_user+0x147/0x1a0 get_perf_callchain+0x12d/0x1c0 ... perf_event_nmi_handler+0x26/0x50 exc_nmi+0xe8/0x110 RIP: 0010:asm_exc_page_fault+0x0/0x30 The last RIP line shows the NMI landing on the first instruction of the #PF entry. perf with user call chains takes such a fault: the sampling NMI walks the user stack with __get_user(), which faults when a saved frame pointer is not a valid user address or the walk runs off the top of the stack. The same window exists when KVM, running as an L1 hypervisor with DELIVERY_AS_PF_VMEXIT, reads the flags itself after a #PF VM-exit. The NMI entry code saves and restores CR2 for this nesting, but not the async #PF reason. Andy Lutomirski described the race, with perf as the example, when async #PF delivery was reworked in 2020 [1]. Saving and clearing the flags across the NMI, next to CR2, was discussed there but not merged. Since that rework, Linux has stopped setting KVM_ASYNC_PF_SEND_ALWAYS, so the host delivers "page not present" only for user mode faults and a kernel-mode fault in NMI context (including kernel-mode #MC and #DB) cannot be an async page fault. In that case, return without touching the flags so that the interrupted handler finds them intact. Tested on v7.3-rc5 in a 4-vCPU, 2 GiB guest restored from a snapshot whose memory is served on demand through userfaultfd, so that reading it back takes async #PFs, while every thread samples hardware cycles with user call chains and points its frame pointer at an unmapped page. Without this patch the guest panicked as above in 3 of 3 runs. With it, the guest survived 3 of 3 runs of 60 seconds, and the host counted 148,441 to 153,334 kvm_async_pf_not_present events in the first 20 seconds of each. On 6.18.50 the results were the same: the guest panicked without the patch and survived with it. The Linux kernel CVE team has assigned CVE-2026-99178 to this issue. Affected and fixed versions =========================== Fixed in 6.18.59 with commit b77e9622bbade9812e2090c66d25c372f515e921 Fixed in 7.2.13 with commit f45ee1ff6358a22d7e22a4c53cb3148ea97b10d9 Fixed in 7.3 with commit 81d99abe2bd81379abfb595e403bbbee6fbfc624 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-99178 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: arch/x86/kernel/kvm.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/b77e9622bbade9812e2090c66d25c372f515e921 https://git.kernel.org/stable/c/f45ee1ff6358a22d7e22a4c53cb3148ea97b10d9 https://git.kernel.org/stable/c/81d99abe2bd81379abfb595e403bbbee6fbfc624