Skip to content
Heist/ feed
Unrated

x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 When loading guest XSAVE state via KVM_SET_XSAVE, and when updating XFD in response to a guest WRMSR, clear XFD-disabled features in the saved (or to be restored) XSTATE_BV to ensure KVM doesn't attempt to load state for features that are disabled via the guest's XFD. Because the kernel executes XRSTOR with the guest's XFD, saving XSTATE_BV[i]=1 with XFD[i]=1 will cause XRSTOR to #NM and panic the kernel. E.g. if fpu_update_guest_xfd() sets XFD without clearing XSTATE_BV: ------------[ cut here ]------------ WARNING: arch/x86/kernel/traps.c:1524 at exc_device_not_available+0x101/0x110, CPU#29: amx_test/848 Modules linked in: kvm_intel kvm irqbypass CPU: 29 UID: 1000 PID: 848 Comm: amx_test Not tainted 6.19.0-rc2-ffa07f7fd437-x86_amx_nm_xfd_non_init-vm #171 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:exc_device_not_available+0x101/0x110 Call Trace: asm_exc_device_not_available+0x1a/0x20 RIP: 0010:restore_fpregs_from_fpstate+0x36/0x90 switch_fpu_return+0x4a/0xb0 kvm_arch_vcpu_ioctl_run+0x1245/0x1e40 [kvm] kvm_vcpu_ioctl+0x2c3/0x8f0 [kvm] __x64_sys_ioctl+0x8f/0xd0 do_syscall_64+0x62/0x940 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ---[ end trace 0000000000000000 ]--- This can happen if the guest executes WRMSR(MSR_IA32_XFD) to set XFD[18] = 1, and a host IRQ triggers kernel_fpu_begin() prior to the vmexi

Announced Source revision 1
Original source ↗

CVE-2026-23005

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-23005

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "820a6ee944e74e57255ac2e90916ecdaade57b95",
        "lessThan": "b5995c01ba53d84182ecb9492fc4d91cfe8a362d",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "820a6ee944e74e57255ac2e90916ecdaade57b95",
        "lessThan": "1e2848bda819af569dfe7ab186223855e092a2cb",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "820a6ee944e74e57255ac2e90916ecdaade57b95",
        "lessThan": "f577508cc8a0adb8b4ebe9480bba7683b6149930",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "820a6ee944e74e57255ac2e90916ecdaade57b95",
        "lessThan": "eea6f395ca502c4528314c8112da9b5d65f685eb",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "820a6ee944e74e57255ac2e90916ecdaade57b95",
        "lessThan": "b45f721775947a84996deb5c661602254ce25ce6",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "arch/x86/kernel/fpu/core.c",
      "arch/x86/kvm/x86.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.17"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.17",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.1.162",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.122",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.67",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.7",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "6.19",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "arch/x86/kernel/fpu/core.c",
      "arch/x86/kvm/x86.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-23005

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#39729 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement