Linux kernel KVM nSVM: userspace can trigger a kernel WARN by changing CPUID after loading CR3

Impact

A process that can drive the KVM vCPU ioctls can make nested_svm_load_cr3() fail by setting CR3 and then shrinking the guest's MAXPHYADDR via CPUID, hitting a WARN in svm_set_nested_state(). On its own a WARN is log noise, but on hosts configured with panic_on_warn - common in fleets that want crash dumps for triage - it becomes a remote-from-the-guest-operator way to panic the AMD host, taking every co-tenant GPU workload on that node with it. It also lets an unprivileged local process spam the kernel log. The fix simply deletes the WARN; the underlying state was never a memory-safety problem.

Who can reach it

Local, requires access to /dev/kvm and the ability to call KVM_SET_SREGS / KVM_SET_CPUID / KVM_SET_NESTED_STATE on a vCPU. AMD hosts only (SVM). No network exposure.

What to do

Apply the stable kernel update that removes the WARN and reboot the affected AMD hosts. As an interim measure, if panic_on_warn is enabled on GPU hosts that expose /dev/kvm to tenants, turning it off removes the availability impact and leaves only log noise.

References

Related entries

• Linux kernel scheduler: two yielding tasks can overflow vruntime and destabilize the hostCVE-2026-43323 · Linux kernel sched/fair (zero_vruntime not updated at slice end, EEVDF vruntime overflow)Medium
• Linux kernel BPF: verifier lets a program dereference a nullable map-iterator pointer, crashing the kernelCVE-2026-43333 · Linux kernel BPF verifier (check_mem_access allows direct deref of nullable PTR_TO_BUF)Medium
• Linux kernel Intel uncore PMU: die ID lookup bugs trip a warning and skip PMON unitsCVE-2026-43344 · Linux kernel perf/x86/intel/uncore (die ID init and lookup on Intel SPR/EMR)Medium
• Linux kernel KVM arm64: failed vGIC creation leaves redistributor regions uninitialised for teardownCVE-2026-43351 · Linux kernel KVM arm64 vGIC (dist/redist initialisation on create failure)Medium
• Linux kernel CephFS client: leaked path buffers on error paths exhaust kernel memoryCVE-2026-43419 · Linux kernel CephFS client (ceph_mdsc_build_path error paths)Medium
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A correctness defect in the amdkfd (KFD computeCVE-2026-43444 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)Medium