Linux kernel (arch/x86/kvm): A guest that is in SMM and then triple-faults makes SVM take the SHUTDOWN intercept and

Impact

A guest that is in SMM and then triple-faults makes SVM take the SHUTDOWN intercept and reset the vCPU without first forcing it out of SMM, leaving host-side vCPU state in an architecturally impossible configuration. The same omission in the nested path was previously a use-after-free, and the kernel CNA rates this one as a scope-changing confidentiality, integrity and availability break.

Who can reach it

Guest-driven on AMD hosts and reproduced by syzkaller with nothing but a VM and one vCPU: enter SMM (a guest can direct an SMI at itself through the emulated local APIC, or the VMM's KVM_SMI path is used) and then execute instructions that cascade into a triple fault. No passthrough device and no host privilege required.

What to do

Update to a stable kernel with the linked fix; the record points at the 5.16 and 6.1 lines, so take the point release on your branch that contains commit e9b28bc65fd3. No meaningful interim control - SMM emulation cannot be disabled per tenant.

References

Related entries

• Linux kernel (arch/x86/kvm): An emulated MMIO write that straddles a page boundary onto a second MMIO page is splitCVE-2026-31588 · Linux kernel (arch/x86/kvm)High
• Linux kernel (arch/x86/kvm): When KVM failed to program the interrupt remapping table for irq bypass, it left aCVE-2026-72283 · Linux kernel (arch/x86/kvm)High
• Linux kernel (arch/x86/kvm): A nested guest can put an out-of-range virtual-processor ID into an enlightened VMCS andCVE-2026-64247 · Linux kernel (arch/x86/kvm)High
• Linux kernel (arch/x86/kvm): A guest that is not advertised long mode makes the host's SMM emulator walk 16CVE-2022-49883 · Linux kernel (arch/x86/kvm)High
• Linux kernel (arch/x86/kvm): A guest that disables paravirtual EOI while KVM still has a pending PV-EOI request, andCVE-2026-72284 · Linux kernel (arch/x86/kvm)High
• Linux kernel (arch/x86/kvm): A failed RSM leaves the vCPU's SMM flag and the MMU role out of sync, so KVM resolves aCVE-2021-47230 · Linux kernel (arch/x86/kvm)Medium