Linux kernel KVM nSVM: L2 guest can issue hypercalls as if it were L1 when VMMCALL is not intercepted

Impact

On AMD hosts, when L2 is active, L1 does not intercept VMMCALL and nested_svm_l2_tlb_flush_enabled() is true, KVM intercepts VMMCALL but never forwards it to L1 - so a nested guest can make hypercalls as though it were the L1 hypervisor instead of taking the architectural #UD. That is a confused-deputy path across a nesting boundary on exactly the hosts a GPU cloud uses to sell nested-capable AMD instances, and it breaks the isolation assumption the L1 hypervisor is written against. The fix explicitly synthesizes #UD for unsupported hypercalls in that state. The record does not demonstrate host escape or data disclosure; treat it as a nesting isolation break rather than a proven escape.

Who can reach it

Local: code running in a nested (L2) guest on an AMD host with nested SVM enabled. Requires the operator to have exposed nested virtualization to the tenant; no network path.

What to do

Apply the stable kernel fix for your branch (commits in the references) and reboot the hypervisor node, or reload kvm_amd with all VMs stopped. Until then, disabling nested virtualization (kvm_amd nested=0) for tenant VMs removes the condition entirely and is the cheaper interim step.

References

Related entries

• util-linux nsenter: --join-cgroup leaks a root-opened cgroup.procs fd into the target containerCVE-2026-78408 · util-linux nsenter (--join-cgroup descriptor leak across execve)High
• Linux kernel KVM/arm64: guest-controlled TLBI Range can overflow the hypervisor's range computationCVE-2026-89911 · Linux kernel KVM arm64 (TLBI by Range)High
• Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_user: Straight local-to-root. RDS - theCVE-2010-3904 · Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_userHigh
• Linux kernel KVM device assignment IOMMU path virt/kvm/iommu.c - kvm_iommu_map_pages: When an IOMMU mapping failsCVE-2014-3601 · Linux kernel KVM device assignment IOMMU path virt/kvm/iommu.c - kvm_iommu_map_pagesHigh
• ABRT: symlink attack on predictable core-dump paths gives local users root on RHEL hostsCVE-2015-5287 · ABRT abrt-hook-ccpp (core dump helper on RHEL/CentOS)High
• Linux kernel (mm, COW): Dirty COW: privilege escalation via MAP_PRIVATE COW breakageCVE-2016-5195 · Linux kernel (mm, COW)High