CVE-2026-79611: VMX: VMentry failure with branch tracing and blocked states
For XSA-308 logic was introduced, as VMX VMEntry checks do not like the exact combination of state which occurs when #DB in intercepted, Single Stepping is active, and blocked by STI/MovSS is active, despite this being a legitimate state to be in. The resulting VMEntry failure is fatal to the guest.
Sadly there is another special sub-case of the above, with branch tracing enabled. In that case the prior adjustment would still cause a VMentry failure, as before fatal to the guest.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Xen VMX guests can be affected when debug exceptions are intercepted, single stepping is active, and execution is blocked by STI or MOV SS. The branch-tracing sub-case can still trigger a fatal VM entry failure despite the prior XSA-308 adjustment.
What is the observable impact if the condition is triggered?
The VM entry failure is fatal to the affected guest. The provided information does not describe an impact on the Xen host.