CVE-2026-72284
Received Received - Intake

KVM: x86 Denial of Service via PV EOI Handling

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs Ignore KVM's internal "service pending PV EOI" request if the vCPU has disabled PV EOIs since the request was made. Asserting that PV EOIs are enabled can fail if reading guest memory in pv_eoi_get_user() fails, i.e. if pv_eoi_test_and_clr_pending() bails early, *and* the vCPU also disables PV EOIs. kernel BUG at arch/x86/kvm/lapic.c:3338! Oops: invalid opcode: 0000 [#1] SMP CPU: 4 UID: 1000 PID: 890 Comm: pv_eoi_test Not tainted 7.0.0-d585aa5894d8-vm #337 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:kvm_lapic_sync_from_vapic+0x12b/0x140 [kvm] Call Trace: <TASK> kvm_arch_vcpu_ioctl_run+0x1075/0x1c30 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0xb40 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> Modules linked in: kvm_intel kvm irqbypass ---[ end trace 0000000000000000 ]---

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72284
EUVD
EUVD-2026-59183

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in KVM's handling of pending paravirtualized end-of-interrupt (PV EOI) requests. When a virtual CPU (vCPU) disables PV EOIs after a pending request is made but before it is processed, the kernel may incorrectly assert that PV EOIs are still enabled. This can lead to a kernel bug check and crash due to an invalid opcode.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem and may not have direct network detection methods. Look for kernel oops or crash logs related to KVM or virtualization. Check system logs for traces of invalid opcode errors or kernel panics involving kvm_lapic_sync_from_vapic.

Impact Analysis

This vulnerability can cause a denial-of-service (DoS) condition by crashing the host system running the vulnerable Linux kernel. If exploited, it may lead to unexpected reboots or system instability, potentially disrupting services or causing data loss.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. If using a virtualization host, ensure all KVM-related modules are updated. Monitor kernel logs for any signs of the described crash or oops.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72284. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart