CVE-2026-64284
Received Received - Intake

KVM Fastpath Userspace Exit Handling in Linux Kernel

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Move the handling of fastpath userspace exits into vendor code to ensure KVM runs vendor specific operations that need to run before userspace gains control of the vCPU. E.g. for VMX (and soon to be for SVM as well), KVM needs to flush the PML buffer prior to exiting to userspace, otherwise any memory written by the final KVM_RUN might never be flagged as dirty. Note, waiting to snapshot CR0 and CR3 until svm_handle_exit() is flawed in general, as that risks consuming stale state in a fastpath handler. That will be addressed in a future change.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64284
EUVD
EUVD-2026-48996

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves KVM (Kernel-based Virtual Machine) on x86 systems. The issue ensures that vendor-specific exit handlers run before fastpath userspace exits. This prevents stale state consumption and ensures proper handling of memory writes during KVM_RUN operations, such as flushing the PML buffer in VMX.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM (Kernel-based Virtual Machine) x86 implementation. Detection requires checking the kernel version and KVM module behavior. Use 'uname -r' to check the kernel version and 'lsmod | grep kvm' to verify KVM modules are loaded. If your kernel version is vulnerable, you may see issues with VMX/SVM exit handling.

Impact Analysis

If exploited, this vulnerability could lead to improper memory state handling in virtual machines, potentially causing data corruption or security issues. Systems relying on KVM for virtualization may experience instability or incorrect behavior during virtual machine operations.

Mitigation Strategies

Update the Linux kernel to the latest patched version. If immediate patching is not possible, disable KVM virtualization by unloading the KVM modules with 'rmmod kvm_intel' or 'rmmod kvm_amd' depending on your CPU. Monitor vendor advisories for kernel updates addressing this issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64284. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart