CVE-2026-99258
Received Received - Intake

x86/hyperv Hypercall Output Page Use in hv_apicid_to_vp_index

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index() hv_apicid_to_vp_index() currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP CoCo VM with no paravisor. In the former case, the output page is allocated, but in the latter case it is not, so the hypervisor stores the output VP index in memory that has not been allocated by the guest. Fix this by using the input page for both input and output. The hypercall has very small input and output, so sharing the same page for both is straightforward. An alternative fix is to allocate the per-cpu output page when running in an SEV-SNP CoCo guest, but this uses significantly more memory, particularly with larger vCPUs counts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-99258
EUVD
EUVD-2026-115769

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
Linux Linux 3d12349ade541eefde0e71bf5c4aa7aa04c52a79
Linux Linux 86c48271e0d60c82665e9fd61277002391efcef7
Linux Linux 86c48271e0d60c82665e9fd61277002391efcef7
Linux Linux 86c48271e0d60c82665e9fd61277002391efcef7
Linux Linux cb002d6c8f06d6061e84b2109cb84416107a9fb9
Linux Linux 6.12.41
Linux Linux 6.15.3
Linux Linux 6.16

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a function called hv_apicid_to_vp_index() which incorrectly uses per-cpu output pages for hypercalls. When running in certain environments like VTL2 or SEV-SNP CoCo VMs without a paravisor, the output page may not be allocated, leading the hypervisor to write data to unallocated memory. The fix involves using the same page for both input and output to avoid this issue.

Impact Analysis

This vulnerability could lead to memory corruption or crashes in affected systems, particularly those running in VTL2 or SEV-SNP CoCo VMs without a paravisor. It may cause instability or unexpected behavior in the Linux kernel, potentially disrupting services or applications running on vulnerable systems.

Mitigation Strategies

Update the Linux kernel to the patched version that includes the fix for hv_apicid_to_vp_index().

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99258. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...