PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45987 Linux CVE debrief

A state synchronization flaw in the Linux kernel's KVM nested virtualization (nSVM) implementation can cause L2 guest vCPUs to hang when restoring nested state. The vulnerability exists because the interrupt shadow state (int_state bit 0, SVM_INTERRUPT_SHADOW_MASK) written by the CPU during VMRUN was not synchronized to the cached vmcb12 structure. When KVM_SET_VCPU_EVENTS precedes KVM_SET_NESTED_STATE during state restoration, the interrupt shadow is incorrectly restored to vmcb01 instead of vmcb02. For L2 guests, this can prevent wakeup interrupts from being delivered, causing the vCPU to hang—particularly problematic if a HLT instruction executes when it should have been in an interrupt shadow. The fix synchronizes int_state to cached vmcb12 in nested_sync_control_from_vmcb02(), ensuring consistent interrupt shadow restoration regardless of the order of KVM ioctls.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

Organizations running nested virtualization with KVM on AMD SVM hardware; cloud providers offering nested virtualization; Linux kernel maintainers; virtualization security teams

Technical summary

The vulnerability is in KVM's nested SVM (nSVM) implementation. After VMRUN in guest mode, nested_sync_control_from_vmcb02() synchronizes CPU-written fields from vmcb02 to cached vmcb12 for use as authoritative control state and nested state save/restore payload. However, int_state (specifically bit 0/SVM_INTERRUPT_SHADOW_MASK for nested VMs) was not synchronized. When KVM_SET_VCPU_EVENTS precedes KVM_SET_NESTED_STATE during restoration, the interrupt shadow is restored to vmcb01 instead of vmcb02. For L2 guests, this can cause vCPU hangs if wakeup interrupts arrive before HLT instructions that should have been in an interrupt shadow. The fix adds int_state synchronization to nested_sync_control_from_vmcb02().

Defensive priority

medium

Recommended defensive actions

  • Apply the relevant stable kernel patch for your kernel version from the Linux kernel stable tree
  • Verify KVM nested virtualization workloads are running on patched kernels
  • Monitor for kernel updates that assign CVSS scoring and severity ratings
  • Review VM snapshot/restore procedures to ensure proper ordering of KVM ioctls as a defense-in-depth measure

Evidence notes

The vulnerability description is sourced from the official CVE record published 2026-05-27. The fix involves synchronizing the int_state field to cached vmcb12 in nested_sync_control_from_vmcb02(). Multiple stable kernel commits are referenced in the NVD record. No CVSS score or severity has been assigned as of the modified date (2026-05-27). The vendor is identified as the Linux kernel project based on source domain evidence.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45987 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45987

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45987 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45987

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/03bee264f8ebfd39e0254c98e112d033a7aa9055

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1709418535a8df95532999d61b03d59975280258

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2f950eeb27af6885416232761700b8820cae0a61

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/497f6af9679fc9c6ce2f438e11ed5d51b1aa8297

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e0377e52f3c10ee572732d11b04625b7f517a862

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.