CVE-2026-74607
Received Received - Intake

Race Condition in Linux Kernel KVM SVM Module

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Interaction between KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM and KVM_CAP_VM_COPY_ENC_CONTEXT_FROM can cause two separate issues: - in sev_migrate_from(), when the destination KVM is a mirror, the mirror entry is moved from the source's list to the owner's mirror_vms list, without holding the owner's lock unlike other writers of the owner's mirror list (sev_vm_copy_enc_context_from(), sev_vm_destroy()). A concurrent COPY or destroy can race with sev_migrate_from() and corrupt the list. - In sev_vm_destroy(), the *owner* is still active and could receive concurrently a KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM that causes sev->enc_context_owner to change. In this case the incorrect VM receives kvm_put_kvm(). The second issue needs particular care because the owner could disappear altogether (even though the race window is impossibly small) between reading it and locking it. There is thus no way to perform the checks under the owner lock without putting struct kvm under SLAB_TYPESAFE_BY_RCU (which would allow kvm_get_kvm_safe() under RCU critical section). It is much simpler to just use a global lock, since the critical sections are so small and the new lock is always a leaf lock.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74607
EUVD
EUVD-2026-64544

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in KVM (Kernel-based Virtual Machine) related to SEV (Secure Encrypted Virtualization) context migration. It occurs when two operations, KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM and KVM_CAP_VM_COPY_ENC_CONTEXT_FROM, interact improperly. The issue stems from unprotected access to shared lists (owner and mirror lists) during context migration, potentially corrupting these lists and causing incorrect VM references.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem, particularly in the AMD Secure Encrypted Virtualization (SEV) implementation. Detection requires checking the kernel version and KVM module behavior. Use commands like 'uname -a' to check kernel version and 'lsmod | grep kvm' to verify KVM modules. Monitor kernel logs for SEV-related errors or crashes.

Impact Analysis

This vulnerability could lead to memory corruption, crashes, or incorrect behavior in virtual machines using SEV. An attacker with access to a guest VM might exploit this to cause denial-of-service conditions or escalate privileges within the host system. Systems relying on KVM for virtualization are primarily affected.

Mitigation Strategies

Immediately update the Linux kernel to the latest stable version that includes the fix for this vulnerability. If updating is not immediately possible, disable KVM SEV functionality by setting 'sev=0' in the KVM module parameters or blacklisting the KVM module until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74607. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart