CVE-2026-64172 Linux CVE debrief

Who should care

System administrators and security teams managing Linux kernel-based systems, particularly those using Hygon Family 18h CPUs, should be aware of this vulnerability. They should assess their system's exposure and apply necessary patches or workarounds to prevent potential exploitation.

Technical summary

The vulnerability is related to the KVM: SVM component of the Linux kernel. Specifically, it affects Hygon Family 18h CPUs, which share the same erratum #1235 as AMD Family 17h CPUs. The issue arises during ICR write emulation, where hardware may read a stale IsRunning=1 bit, causing a failure to generate a VM-Exit. This leads to missed wakeups of blocking target vCPUs, resulting in hung vCPUs and delays in guest execution. The solution involves extending the existing workaround for AMD Family 17h to also cover Hygon Family 18h, effectively disabling AVIC IPI virtualization.

Defensive priority

High priority should be given to patching or mitigating this vulnerability, especially in environments where Hygon Family 18h CPUs are used. The impact of exploitation could lead to system hangs and performance issues in virtualized environments.

Recommended defensive actions

• Apply the official patch provided by the Linux kernel maintainers to disable AVIC IPI virtualization on Hygon Family 18h CPUs.
• Perform inventory checks to identify systems using Hygon Family 18h CPUs and assess their exposure.
• Monitor system performance and logs for signs of exploitation or related issues.
• Consider implementing compensating controls, such as limiting the use of IPI virtualization in critical systems.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The evidence for this vulnerability comes from official Linux kernel sources and references provided by the CVE and NVD. The vulnerability is well-documented, and patches are available. However, the impact and potential for exploitation should be carefully assessed based on specific system configurations and usage.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.