CVE-2026-64513 Linux kernel CVE debrief

Who should care

System administrators and security teams responsible for Linux kernel-based virtualization environments, particularly those using KVM, should be aware of this vulnerability. This vulnerability may be relevant to environments running on older platforms or under nested virtualization.

Technical summary

The Linux kernel's KVM subsystem has a vulnerability related to the handling of TPR_THRESHOLD in the VMCS. When the guest's virtual TPR falls under the specified threshold, VM exits are induced, allowing KVM to inject previously masked interrupts. However, in certain scenarios, such as on older platforms or under nested virtualization, this can cause a VM entry failure with hardware error 0x7. The issue arises from the optimization made in handle_tpr_below_threshold(), which calls apic_update_ppr() instead of raising KVM_REQ_EVENT. If there are no new interrupts pending, apic_update_ppr() does not issue the request, leading to a high, stale TPR_THRESHOLD.

Defensive priority

Medium

Recommended defensive actions

• Apply the kernel patch to update the CR8 intercept on PPR update
• Verify and apply the latest kernel updates
• Monitor system logs for potential VM entry failures
• Consider implementing compensating controls, such as nested virtualization checks
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability was resolved by unconditionally recomputing CR8 intercept on PPR update. The fix involves calling kvm_lapic_update_cr8_intercept() if apic_update_ppr() does not find a deliverable interrupt. Official references include kernel.org stable commits.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.