CVE-2026-72284

CVE CVE-2026-72284EUVD EUVD-2026-59183Published 2026-08-15T05:55:07.000ZLast changed 2026-08-17T05:42:19.000ZCVSS 7.1

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs Ignore KVM's internal "service pending PV EOI" request if the vCPU has disabled PV EOIs since the request was made. Asserting that PV EOIs are enabled can fail if reading guest memory in pv_eoi_get_user() fails, i.e. if pv_eoi_test_and_clr_pending() bails early, *and* the vCPU also disables PV EOIs. kernel BUG at arch/x86/kvm/lapic.c:3338! Oops: invalid opcode: 0000 [#1] SMP CPU: 4 UID: 1000 PID: 890 Comm: pv_eoi_test Not tainted 7.0.0-d585aa5894d8-vm #337 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:kvm_lapic_sync_from_vapic+0x12b/0x140 [kvm] Call Trace: <TASK> kvm_arch_vcpu_ioctl_run+0x1075/0x1c30 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0xb40 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> Modules linked in: kvm_intel kvm irqbypass ---[ end trace 0000000000000000 ]---

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux 3.6; patch: 6.18.40; ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb <8e9f7a95279bf608cf4c331ed89612e28c04564f; patch: 6.12.97; patch: 6.1.178; patch: 7.1.5; patch: 0; ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb <32bdca80aa81c2cb906f50a88b220ce1ecdc5e6e; ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb <97542f15dc4cf6cd3fdc035e482dca54246ddf48; ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb <038b9ce6fafda1babd1e33d52cbc6039747a6d87; patch: 7.2; patch: 6.6.145; ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb <ebd7845ca0471d251a1cb48d84eb165aff5b7123; ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb <9285e4070df2c40585c3d7ec9571faa7a2b97e17

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.