PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64172 Linux CVE debrief

The Linux kernel's KVM: SVM has a vulnerability affecting Hygon Family 18h CPUs, which are derived from AMD Family 17h silicon. The erratum #1235 causes hardware to read a stale IsRunning=1 bit during ICR write emulation, leading to a failure in generating an AVIC_IPI_FAILURE_TARGET_NOT_RUNNING VM-Exit on the sending vCPU. This results in KVM missing the required wakeup of blocking target vCPUs, causing hung vCPUs and unbounded delays in guest execution. The existing AMD Family 17h erratum #1235 workaround has been extended to cover Hygon Family 18h. Disabling IPI virtualization prevents KVM from setting IsRunning=1 in the Physical ID table, ensuring every non-self IPI generates a VM-Exit and is correctly emulated.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-19
Original CVE updated
2026-07-19
Advisory published
2026-07-19
Advisory updated
2026-07-19

Who should care

System administrators and security teams managing Linux kernel-based systems, particularly those using Hygon Family 18h CPUs, should be aware of this vulnerability. They should assess their system's exposure and apply necessary patches or workarounds to prevent potential exploitation.

Technical summary

The vulnerability is related to the KVM: SVM component of the Linux kernel. Specifically, it affects Hygon Family 18h CPUs, which share the same erratum #1235 as AMD Family 17h CPUs. The issue arises during ICR write emulation, where hardware may read a stale IsRunning=1 bit, causing a failure to generate a VM-Exit. This leads to missed wakeups of blocking target vCPUs, resulting in hung vCPUs and delays in guest execution. The solution involves extending the existing workaround for AMD Family 17h to also cover Hygon Family 18h, effectively disabling AVIC IPI virtualization.

Defensive priority

High priority should be given to patching or mitigating this vulnerability, especially in environments where Hygon Family 18h CPUs are used. The impact of exploitation could lead to system hangs and performance issues in virtualized environments.

Recommended defensive actions

  • Apply the official patch provided by the Linux kernel maintainers to disable AVIC IPI virtualization on Hygon Family 18h CPUs.
  • Perform inventory checks to identify systems using Hygon Family 18h CPUs and assess their exposure.
  • Monitor system performance and logs for signs of exploitation or related issues.
  • Consider implementing compensating controls, such as limiting the use of IPI virtualization in critical systems.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The evidence for this vulnerability comes from official Linux kernel sources and references provided by the CVE and NVD. The vulnerability is well-documented, and patches are available. However, the impact and potential for exploitation should be carefully assessed based on specific system configurations and usage.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-19T16:17:59.383Z and has not been modified since then.