Linux kernel (arch/x86/kvm/svm): After a CPU offline/online cycle, KVM's ASID generation counter is reset in a way that

Impact

After a CPU offline/online cycle, KVM's ASID generation counter is reset in a way that lets two vCPUs belonging to DIFFERENT VMs run on the same physical CPU with the same ASID. They then share nested-page-table TLB entries, so one tenant's guest resolves addresses through another tenant's translations. This is direct cross-tenant memory read and write exposure, with no attacker skill required once the condition exists.

Who can reach it

No tenant action needed to create the hazard - it is created by the operator's own CPU hotplug (maintenance, core parking, power management) on AMD nodes running kvm_amd. Any two co-resident guests pinned to the recycled pCPU can end up sharing an ASID; a tenant that can influence its own vCPU placement and probe memory will notice foreign data. AMD SVM only.

What to do

Update to a kernel with the referenced stable commits. Interim, and this one is actionable today: stop doing CPU offline/online cycles on AMD hypervisor nodes carrying live guests - drain the node before any hotplug operation, and reboot rather than hot-cycling CPUs.

References

Related entries

• Linux kernel (arch/x86/kvm/svm): On AMD hosts that cannot report the next RIP, KVM's WRMSR/HLT/INVD fastpath has toCVE-2025-40038 · Linux kernel (arch/x86/kvm/svm)High
• Linux kernel (arch/x86/kvm/svm): Page State Change requests from a confidential guest were validated against theCVE-2026-63938 · Linux kernel (arch/x86/kvm/svm)Critical
• Linux kernel (arch/x86/kvm/svm): KVM computed the usable size of the guest-provided GHCB scratch area wrongly, so aCVE-2026-63939 · Linux kernel (arch/x86/kvm/svm)Critical
• Linux kernel (arch/x86/kvm/svm): A confidential guest can hand KVM a port-I/O request with length or count zeroCVE-2026-63940 · Linux kernel (arch/x86/kvm/svm)Critical
• Linux kernel (arch/x86/kvm/svm): When a GSI route changed to something that cannot be posted, KVM only fixed up theCVE-2025-37885 · Linux kernel (arch/x86/kvm/svm)High
• Linux kernel (arch/x86/kvm/svm): KVM read Page State Change entries and indices out of a guest-writable buffer moreCVE-2026-63937 · Linux kernel (arch/x86/kvm/svm)High