VMX Vulnerability in Linux Kernel Affecting QEMU

CVE-2026-64604

What is CVE-2026-64604?

A vulnerability exists in the Linux kernel relating to VMX operations during CR8 interception updates. Specifically, the flaw occurs when vmcs12 is grabbed during the CR8 intercept update only if the virtual CPU (vCPU) operates in guest mode. This condition aims to facilitate updates during vCPU creation without breaching the lock dependency assertions of the get_vmcs12() function, which ensures a stable virtual machine state. Debugging alerts have been triggered, indicating potential issues when these conditions are not met. While the vulnerability does not introduce functional changes, it highlights an important aspect of virtual machine management that needs to be monitored for optimal security.

References