CVE-2026-64172— KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)
Possible ATT&CK Techniques 1AI
T1499.004 · Application or System ExploitationAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 8de4a1c8164e5b2e40d1df764840a31de983f40b< 94ade38f317ea086a181db0e6b69c574b3b70a5e | affected |
8de4a1c8164e5b2e40d1df764840a31de983f40b< 9560e6fee887a9594a89fa265b5b9c79b1591803 | affected | ||
8de4a1c8164e5b2e40d1df764840a31de983f40b< 9a12fa5213cfc391e0eed63902d3be98f0913765 | affected | ||
6.17 | affected | ||
< 6.17 | unaffected | ||
6.18.34≤ 6.18.* | unaffected | ||
7.0.11≤ 7.0.* | unaffected | ||
7.1≤ * | unaffected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-64172
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235) Hygon Family 18h CPUs are derived from AMD Family 17h (Zen1) silicon and share the same erratum #1235: hardware may read a stale IsRunning=1 bit during ICR write emulation and silently fail to generate an AVIC_IPI_FAILURE_TARGET_NOT_RUNNING VM-Exit on the sending vCPU. The absence of the VM-Exit causes KVM to miss the required wakeup of blocking target vCPUs, leading to hung vCPUs and unbounded delays in guest execution. Extend the existing AMD Family 17h erratum #1235 workaround to also cover Hygon Family 18h. With IPI virtualization disabled, KVM never sets IsRunning=1 in the Physical ID table, so every non-self IPI generates a VM-Exit and is correctly emulated.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于KVM SVM中AVIC IPI虚拟化在Hygon Family 18h CPU上硬件可能读取过时的IsRunning=1位，导致无法生成VM-Exit，从而造成目标vCPU挂起和客户机执行无限延迟。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-64172
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-64172
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-64172 (3)
Same Patch Batch · Linux · 2026-07-19 · 431 CVEs total
| CVE-2026-63795 | 10.0 CRITICAL | 9p: avoid putting oldfid in p9_client_walk() error path |
| CVE-2026-63800 | 9.8 CRITICAL | pNFS: Fix use-after-free in pnfs_update_layout() |
| CVE-2026-64055 | 9.8 CRITICAL | net: ethernet: cortina: Carry over frag counter |
| CVE-2026-64056 | 9.8 CRITICAL | net: ethernet: cortina: Make RX SKB per-port |
| CVE-2026-64061 | 9.8 CRITICAL | netfs: Fix early put of sink folio in netfs_read_gaps() |
| CVE-2026-64066 | 9.8 CRITICAL | netfs: Fix netfs_read_to_pagecache() to pause on subreq failure |
| CVE-2026-64067 | 9.8 CRITICAL | netfs: Fix missing barriers when accessing stream->subrequests locklessly |
| CVE-2026-64068 | 9.8 CRITICAL | netfs: Fix missing locking around retry adding new subreqs |
| CVE-2026-64069 | 9.8 CRITICAL | netfs: Fix cancellation of a DIO and single read subrequests |
| CVE-2026-63808 | 9.8 CRITICAL | exfat: fix potential use-after-free in exfat_find_dir_entry() |
| CVE-2026-64089 | 9.8 CRITICAL | batman-adv: tt: fix negative last_changeset_len |
| CVE-2026-64091 | 9.8 CRITICAL | batman-adv: tt: fix TOCTOU race for reported vlans |
| CVE-2026-53399 | 9.8 CRITICAL | nfsd: release layout stid on setlease failure |
| CVE-2026-64142 | 9.8 CRITICAL | ksmbd: close durable scavenger races against m_fp_list lookups |
| CVE-2026-53398 | 9.8 CRITICAL | NFSD: Fix SECINFO_NO_NAME decode error cleanup |
| CVE-2026-64136 | 9.8 CRITICAL | smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() |
| CVE-2026-64132 | 9.8 CRITICAL | ipv6: ioam: refresh hdr pointer before ioam6_event() |
| CVE-2026-64122 | 9.8 CRITICAL | net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover |
| CVE-2026-64102 | 9.8 CRITICAL | RDMA/siw: Reject MPA FPDU length underflow before signed receive math |
| CVE-2026-64113 | 9.8 CRITICAL | ixgbevf: fix use-after-free in VEPA multicast source pruning |
Showing top 20 of 431 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-64556
perf/core: Detach event groups during remove_on_exec - CVE-2026-64557
Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_conne - CVE-2026-64554
netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragm - CVE-2026-64555
KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops( - CVE-2026-64552
virtio-net: fix len check in receive_big()
Same vendor: Linux
- CVE-2026-64556
perf/core: Detach event groups during remove_on_exec - CVE-2026-64557
Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_conne - CVE-2026-64554
netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragm - CVE-2026-64555
KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops( - CVE-2026-64552
virtio-net: fix len check in receive_big()
V. Comments for CVE-2026-64172
No comments yet