Linux kernel KVM: spurious userspace exit when checking nested events can kill the guest

Impact

If a vCPU leaves a blocking state while L2 is active and the nested-event check returns -EBUSY, KVM exits to userspace with what is usually KVM_EXIT_UNKNOWN. The VMM has no sensible way to handle that and the VM typically dies. Reaching the state requires userspace to have stuffed MP_STATE or injected events into the vCPU - something a VMM can do, and something a guest-adjacent control path can be coaxed into. For a GPU cloud that hands tenants nested virtualization or runs confidential VMs, the result is an availability problem: the guest is lost, not the host. The host kernel keeps running, so this is a tenant-VM crash rather than a node-level outage.

Who can reach it

Local, through the KVM ioctl interface - a process holding /dev/kvm or the VMM itself must set the vCPU into the odd state. Not reachable from inside an unprivileged guest on its own, and not reachable over the network.

What to do

Pick up the stable kernel fix and restart the affected VMs; because the change is in the kvm module, a node can be remediated by draining the guests and reloading kvm/kvm_intel rather than a full reboot in some configurations, but the practical path for most fleets is a kernel update and node reboot. No configuration workaround is described in the fix.

References

Related entries

• Linux kernel EFI/CPER: an oversized ARM processor error record is trusted and read past the firmware bufferCVE-2026-43266 · Linux kernel EFI/CPER ARM processor error record parser (section_length / ERR_INFO_NUM not bounded)Medium
• Linux kernel CephFS client: punch-hole writes without snapshot context silently corrupt existing snapshotsCVE-2026-43273 · Linux kernel CephFS client (ceph_zero_partial_object missing snapshot context on OSD writes)Medium
• Linux kernel KVM nSVM: userspace can trigger a kernel WARN by changing CPUID after loading CR3CVE-2026-43315 · Linux kernel KVM nSVM (user-triggerable WARN in svm_set_nested_state)Medium
• Linux kernel scheduler: two yielding tasks can overflow vruntime and destabilize the hostCVE-2026-43323 · Linux kernel sched/fair (zero_vruntime not updated at slice end, EEVDF vruntime overflow)Medium
• Linux kernel BPF: verifier lets a program dereference a nullable map-iterator pointer, crashing the kernelCVE-2026-43333 · Linux kernel BPF verifier (check_mem_access allows direct deref of nullable PTR_TO_BUF)Medium
• Linux kernel Intel uncore PMU: die ID lookup bugs trip a warning and skip PMON unitsCVE-2026-43344 · Linux kernel perf/x86/intel/uncore (die ID init and lookup on Intel SPR/EMR)Medium