UBUNTU-CVE-2026-99258: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hvapicidtovpindex() hvapicidtovpindex() currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP CoCo VM with no paravisor. In the former case, the output page is allocated, but in the latter case it is not, so the hypervisor stores the output VP index in memory that has not been allocated by the guest. Fix this by using the input page for both input and output. The hypercall has very small input and output, so sharing the same page for both is straightforward. An alternative fix is to allocate the per-cpu output page when running in an SEV-SNP CoCo guest, but this uses significantly more memory, particularly with larger vCPUs counts.
Affected Software
Event History
Frequently Asked Questions
Which environments are affected by the unallocated-memory write described here?
The issue occurs when the kernel runs as an SEV-SNP confidential-computing VM without a paravisor. In that configuration, the per-CPU hypercall output page is not allocated, but the hypervisor writes the VP index to it.
Does the same condition apply to VTL2 deployments?
No. The function is also called in VTL2, but the per-CPU output page is allocated there. The unallocated output-page condition described for this issue is specific to SEV-SNP CoCo VMs with no paravisor.
Which Ubuntu kernel package families are listed for this vulnerability?
The listed packages are linux, linux-fips, linux-aws, linux-azure, linux-gcp, linux-oracle, linux-aws-fips, and linux-azure-fips.
What does the resolved kernel change do?
The fix uses the per-CPU hypercall input page for both the input and output of hv_apicid_to_vp_index(). This avoids relying on a separate per-CPU output page in the affected configuration.