CVE-2026-43265

KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()

MEDIUM
5.5
CVSS Score
Published: May 6, 2026 at 11:28 AM UTC
Updated: June 17, 2026 at 10:49 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() Ignore -EBUSY when checking nested events after exiting a blocking state while L2 is active, as exiting to userspace will generate a spurious userspace exit, usually with KVM_EXIT_UNKNOWN, and likely lead to the VM's demise. Continuing with the wakeup isn't perfect either, as *something* has gone sideways if a vCPU is awakened in L2 with an injected event (or worse, a nested run pending), but continuing on gives the VM a decent chance of surviving without any major side effects. As explained in the Fixes commits, it _should_ be impossible for a vCPU to be put into a blocking state with an already-injected event (exception, IRQ, or NMI). Unfortunately, userspace can stuff MP_STATE and/or injected events, and thus put the vCPU into what should be an impossible state. Don't bother trying to preserve the WARN, e.g. with an anti-syzkaller Kconfig, as WARNs can (hopefully) be added in paths where _KVM_ would be violating x86 architecture, e.g. by WARNing if KVM attempts to inject an exception or interrupt while the vCPU isn't running.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

6.1 ≤ v < 6.1.1676.1 ≤ v < 6.12.776.1 ≤ v < 6.18.176.1 ≤ v < 6.19.66.1 ≤ v < 6.6.1306.1 ≤ v < 7.06.13 ≤ v < 6.18.176.19 ≤ v < 6.19.66.2 ≤ v < 6.6.1306.7 ≤ v < 6.12.7726844fee6adee9b1557d2279b0506285de9ee82b6.1
Vendor states this is fixed in 1c957773063ed3264953597e32990a748381caf6 (fixed)
Vendor states this is fixed in 1e88b5f854bdb469424132e0bb44793ad7a7c20a (fixed)
Vendor states this is fixed in 2657439265d34a911886b916ba8be97ecc117d51 (fixed)
Vendor states this is fixed in 78265cd066d73a5cb41c088fcae4a2515e480d97 (fixed)
Vendor states this is fixed in ead63640d4e72e6f6d464f4e31f7fecb79af8869 (fixed)
Vendor states this is fixed in ec3be7dc9391085a2d96700e159d66d1328b7ff6 (fixed)
Vendor states this is fixed in 6.1 (unaffected)
Vendor states this is fixed in 6.1.167 (unaffected)
Vendor states this is fixed in 6.12.77 (unaffected)
Vendor states this is fixed in 6.18.17 (unaffected)
Vendor states this is fixed in 6.19.6 (unaffected)
Vendor states this is fixed in 6.6.130 (unaffected)
Vendor states this is fixed in 7.0 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card