UBUNTU-CVE-2026-43214: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Add SRCU protection for reading PDPTRs in getsregs2() Add SRCU read-side protection when reading PDPTR registers in getsregs2(). Reading PDPTRs may trigger access to guest memory: kvmpdptrread() -> svmcachereg() -> loadpdptrs() -> kvmvcpureadguestpage() -> kvmvcpugfntomemslot() kvmvcpugfntomemslot() dereferences memslots via kvmmemslots(), which uses srcudereferencecheck() and requires either kvm->srcu or kvm->slotslock to be held. Currently only vcpu->mutex is held, triggering lockdep warning: ============================= WARNING: suspicious RCU usage in kvmvcpugfntomemslot 6.12.59+ #3 Not tainted include/linux/kvmhost.h:1062 suspicious rcudereferencecheck() usage! other info that might help us debug this: rcuscheduleractive = 2, debuglocks = 1 1 lock held by syz.5.1717/15100: #0: ff1100002f4b00b0 (&vcpu->mutex){+.+.}-{3:3}, at: kvmvcpuioctl+0x1d5/0x1590 Call Trace: <TASK> dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0xf0/0x120 lib/dumpstack.c:120 lockdeprcususpicious+0x1e3/0x270 kernel/locking/lockdep.c:6824 kvmmemslots include/linux/kvmhost.h:1062 [inline] kvmmemslots include/linux/kvmhost.h:1059 [inline] kvmvcpumemslots include/linux/kvmhost.h:1076 [inline] kvmvcpugfntomemslot+0x518/0x5e0 virt/kvm/kvmmain.c:2617 kvmvcpureadguestpage+0x27/0x50 virt/kvm/kvmmain.c:3302 loadpdptrs+0xff/0x4b0 arch/x86/kvm/x86.c:1065 svmcachereg+0x1c9/0x230 arch/x86/kvm/svm/svm.c:1688 kvmpdptrread arch/x86/kvm/kvmcacheregs.h:141 [inline] getsregs2 arch/x86/kvm/x86.c:11784 [inline] kvmarchvcpuioctl+0x3e20/0x4aa0 arch/x86/kvm/x86.c:6279 kvmvcpuioctl+0x856/0x1590 virt/kvm/kvmmain.c:4663 vfsioctl fs/ioctl.c:51 [inline] dosysioctl fs/ioctl.c:907 [inline] sesysioctl fs/ioctl.c:893 [inline] x64sysioctl+0x18b/0x210 fs/ioctl.c:893 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xbd/0x1d0 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x77/0x7f Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1060.63~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1063.71~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1062.69~22.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1063.69~22.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-136.136~22.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1060.61~22.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-134.134.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1058.61~22.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1057.58~22.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-134.134~22.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.8to a version that resolves this vulnerability.Fixed in 6.8.1-1055.56~22.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-134.134 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1060.63 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1063.71 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 6.8.0-1062.69 - Upgrade
Upgrade
ubuntu/linux-azure-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1039.42 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1063.69 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1058.64 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1045.48 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1060.61 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-134.134.1 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1058.61 - Upgrade
Upgrade
ubuntu/linux-nvidia-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-1058.61.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1029.30 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1057.58 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.8.0-1060.64 - Upgrade
Upgrade
ubuntu/linux-xilinxto a version that resolves this vulnerability.Fixed in 6.8.0-1032.33 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1026.30 - Upgrade
Upgrade
ubuntu/linux-raspi-realtimeto a version that resolves this vulnerability.Fixed in 6.8.0-2049.50 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1055.56 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1060.63+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1062.69+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-134.134+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1063.69+fips1 - Compensating control
Add SRCU read-side protection when reading PDPTR registers in __get_sregs2(), ensuring kvm->srcu is held before the PDPTR read can access guest memory through kvm_vcpu_gfn_to_memslot().
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected software list includes Ubuntu linux, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-riscv, linux-gke, and linux-gkeop kernels. Exposure is relevant where KVM x86 virtualization is used.
What access would an attacker need?
The supplied severity vector indicates local access, low attack complexity, no user interaction, and high privileges are required. The issue is associated with reading KVM vCPU PDPTR state through __get_sregs2().
What is the potential impact?
The supplied vector rates confidentiality, integrity, and availability impacts as high, with no impact to the subsequent system. The reported flaw involves an unprotected access to KVM memory-slot state while reading PDPTRs.