Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2026-43483— KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated

AI Predicted 6.6 Difficulty: Moderate EPSS 0.02% · P7

Possible ATT&CK Techniques 1AI

T1498 · Network Denial of Service

Affected Version Matrix 14

VendorProductVersion RangeStatus
LinuxLinux3bbf3565f48ce3999b5a12cde946f81bd4475312< a4123fe5d9122eef9852e4921f7cc463420f30d4affected
3bbf3565f48ce3999b5a12cde946f81bd4475312< 816fa1dfae4532e851b1fe6b2434c753ecbd86c7affected
3bbf3565f48ce3999b5a12cde946f81bd4475312< 01651e7751edbbc0fb4598f8367a3dabcfc8c182affected
3bbf3565f48ce3999b5a12cde946f81bd4475312< ba3bca40f9f25c053f69413e5f4a41dd0fd762bfaffected
3bbf3565f48ce3999b5a12cde946f81bd4475312< 737410b32bd615b321da4fbeda490351b9af5e8baffected
3bbf3565f48ce3999b5a12cde946f81bd4475312< 87d0f901a9bd8ae6be57249c737f20ac0cace93daffected
4.7affected
< 4.7unaffected
… +6 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-43483

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated Explicitly set/clear CR8 write interception when AVIC is (de)activated to fix a bug where KVM leaves the interception enabled after AVIC is activated. E.g. if KVM emulates INIT=>WFS while AVIC is deactivated, CR8 will remain intercepted in perpetuity. On its own, the dangling CR8 intercept is "just" a performance issue, but combined with the TPR sync bug fixed by commit d02e48830e3f ("KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active"), the danging intercept is fatal to Windows guests as the TPR seen by hardware gets wildly out of sync with reality. Note, VMX isn't affected by the bug as TPR_THRESHOLD is explicitly ignored when Virtual Interrupt Delivery is enabled, i.e. when APICv is active in KVM's world. I.e. there's no need to trigger update_cr8_intercept(), this is firmly an SVM implementation flaw/detail. WARN if KVM gets a CR8 write #VMEXIT while AVIC is active, as KVM should never enter the guest with AVIC enabled and CR8 writes intercepted. [Squash fix to avic_deactivate_vmcb. - Paolo]
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在AVIC激活时未正确设置或清除CR8写入拦截，可能导致Windows客户机中TPR与硬件严重不同步。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 3bbf3565f48ce3999b5a12cde946f81bd4475312 ~ a4123fe5d9122eef9852e4921f7cc463420f30d4 -
LinuxLinux 4.7 -

II. Public POCs for CVE-2026-43483

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-43483

请登录查看更多情报信息。

Same Patch Batch · Linux · 2026-05-13 · 14 CVEs total

CVE-2026-43489liveupdate: luo_file: remember retrieve() status
CVE-2026-43487ata: libata-core: Disable LPM on ST1000DM010-2EP102
CVE-2026-43488usb: xhci: Prevent interrupt storm on host controller error (HCE)
CVE-2026-43485nouveau/gsp: drop WARN_ON in ACPI probes
CVE-2026-43486arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults
CVE-2026-43484mmc: core: Avoid bitfield RMW for claim/retune flags
CVE-2026-43482sched_ext: Disable preemption between scx_claim_exit() and kicking helper work
CVE-2026-43480ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition
CVE-2026-43481net-shapers: don't free reply skb after genlmsg_reply()
CVE-2026-43479net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
CVE-2026-43477drm/i915/vrr: Configure VRR timings after enabling TRANS_DDI_FUNC_CTL
CVE-2026-43478ASoC: codecs: rt1011: Use component to get the dapm context in spk_mode_put
CVE-2026-43476iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-43483

No comments yet

Leave a comment