In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush
In KVM guests with Hyper-V hypercalls enabled, the hypercalls HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST and HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST_EX allow a guest to request invalidation of portions of a virtual TLB. For this, the hypercall parameter includes a list of GVAs that are supposed to be invalidated.
However, when non-canonical GVAs are passed, there is currently no filtering in place and they are eventually passed to checked invocations of INVVPID on Intel / INVLPGA on AMD. While AMD's INVLPGA silently ignores non-canonical addresses (effectively a no-op), Intel's INVVPID explicitly signals VM-Fail and ultimately triggers the WARN_ONCE in invvpid_error():
invvpid failed: ext=0x0 vpid=1 gva=0xaaaaaaaaaaaaa000 WARNING: CPU: 6 PID: 326 at arch/x86/kvm/vmx/vmx.c:482 invvpid_error+0x91/0xa0 [kvm_intel] Modules linked in: kvm_intel kvm 9pnet_virtio irqbypass fuse CPU: 6 UID: 0 PID: 326 Comm: kvm-vm Not tainted 6.15.0 #14 PREEMPT(voluntary) RIP: 0010:invvpid_error+0x91/0xa0 [kvm_intel] Call Trace: vmx_flush_tlb_gva+0x320/0x490 [kvm_intel] kvm_hv_vcpu_flush_tlb+0x24f/0x4f0 [kvm] kvm_arch_vcpu_ioctl_run+0x3013/0x5810 [kvm]
Hyper-V documents that invalid GVAs (those that are beyond a partition's GVA space) are to be ignored. While not completely clear whether this ruling also applies to non-canonical GVAs, it is likely fine to make that assumption, and manual testing on Azure confirms "real" Hyper-V interprets the specification in the same way.
Skip non-canonical GVAs when processing the list of address to avoid tripping the INVVPID failure. Alternatively, KVM could filter out "bad" GVAs before inserting into the FIFO, but practically speaking the only downside of pushing validation to the final processing is that doing so is suboptimal for the guest, and no well-behaved guest will request TLB flushes for non-canonical addresses.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-debug-develUpgrade kernel-modulesUpgrade kernel-64k-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-modules-coreUpgrade kernel-debugUpgrade kernel-64k-debug-coreUpgrade kernel-64kUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-coreUpgrade kernel-debug-develUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-64k-develUpgrade kernel-modules-extraUpgrade kernel-rt-64k-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-modules-extraUpgrade kernelUpgrade libperfUpgrade kernel-headersUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-64k-debugUpgrade kernel-abi-stablelistsUpgrade kernel-zfcpdump-modules-extraUpgrade rtlaUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-cross-headersUpgrade kernel-rt-64k-modules-extraUpgrade kernel-coreUpgrade kernel-zfcpdump-develUpgrade kernel-64k-debugUpgrade kernel-64k-modulesUpgrade kernel-debug-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-64k-modules-coreUpgrade kernel-debug-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-rt-64k-modulesUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-debug-coreUpgrade kernel-uki-virtUpgrade kernel-tools-libs-develUpgrade python3-perfUpgrade perfUpgrade rvUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-coreUpgrade kernel-64k-modules-extraUpgrade kernel-rt-develUpgrade kernel-debug-uki-virtUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-debug-develUpgrade kernel-rt-kvmUpgrade kernel-rt-64k-debug-develUpgrade kernel-rt-64k-coreUpgrade kernel-rt-64kUpgrade kernel-toolsUpgrade kernel-develUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-64k-develUpgrade kernel-rt-debugUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-64k-debug-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rtUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-modulesUpgrade kernel-docUpgrade kernel-tools-libs | Oct 14, 2025 | Oct 6, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Oct 9, 2025 | Jul 19, 2025 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Jul 31, 2025 | Jul 19, 2025 |
| Rocky_linux | — | Upgrade kernel-devel-matchedUpgrade kernel-debug-debuginfoUpgrade kernel-toolsUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debugUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rtUpgrade kernel-debuginfo-common-s390xUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-modules-coreUpgrade kernel-uki-virtUpgrade kernel-modulesUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade perfUpgrade kernel-rt-debuginfoUpgrade perf-debuginfoUpgrade kernel-debug-coreUpgrade kernel-coreUpgrade kernel-rt-develUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-kvmUpgrade libperf-debuginfoUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdumpUpgrade kernel-rt-modulesUpgrade kernel-develUpgrade kernel-rt-modules-coreUpgrade rvUpgrade libperfUpgrade kernel-modules-extraUpgrade kernel-tools-libsUpgrade kernel-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-modules-coreUpgrade kernel-debug-devel-matchedUpgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-develUpgrade kernel-zfcpdump-develUpgrade kernelUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-uki-virtUpgrade kernel-tools-debuginfoUpgrade kernel-debugUpgrade kernel-zfcpdump-debuginfoUpgrade rtlaUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-coreUpgrade kernel-rt-coreUpgrade kernel-debug-modulesUpgrade python3-perf | Feb 5, 2026 | Oct 26, 2025 |
| Suse | — | Upgrade dtb-hisiliconUpgrade kernel-default-optionalUpgrade cluster-md-kmp-defaultUpgrade kernel-64kbUpgrade dtb-amdUpgrade kernel-debug-develUpgrade reiserfs-kmp-defaultUpgrade kernel-symsUpgrade kernel-obs-qaUpgrade dtb-apmUpgrade reiserfs-kmp-rtUpgrade ocfs2-kmp-rtUpgrade dtb-exynosUpgrade kernel-zfcpdumpUpgrade dtb-socionextUpgrade kernel-64kb-optionalUpgrade kernel-64kb-develUpgrade kernel-default-baseUpgrade cluster-md-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade kernel-kvmsmallUpgrade kselftests-kmp-64kbUpgrade dtb-amazonUpgrade dtb-renesasUpgrade kernel-azure-extraUpgrade dtb-xilinxUpgrade kernel-default-extraUpgrade kernel-sourceUpgrade dtb-freescaleUpgrade dtb-allwinnerUpgrade dlm-kmp-64kbUpgrade dtb-armUpgrade kernel-default-develUpgrade kernel-devel-rtUpgrade kernel-rt-develUpgrade dtb-mediatekUpgrade gfs2-kmp-64kbUpgrade kernel-debugUpgrade kernel-default-livepatch-develUpgrade kernel-develUpgrade kernel-rt-livepatchUpgrade kernel-devel-azureUpgrade dtb-amlogicUpgrade kernel-default-livepatchUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-defaultUpgrade cluster-md-kmp-azureUpgrade kernel-source-azureUpgrade kernel-kvmsmall-develUpgrade dtb-appleUpgrade gfs2-kmp-rtUpgrade kernel-macrosUpgrade dtb-marvellUpgrade dtb-lgUpgrade kernel-rt_debugUpgrade dlm-kmp-azureUpgrade kernel-azureUpgrade dtb-sprdUpgrade dtb-nvidiaUpgrade kernel-azure-develUpgrade reiserfs-kmp-azureUpgrade kernel-source-rtUpgrade kernel-docs-htmlUpgrade kernel-docsUpgrade kernel-azure-optionalUpgrade kernel-rt-extraUpgrade kernel-rtUpgrade kernel-obs-buildUpgrade dlm-kmp-defaultUpgrade dtb-rockchipUpgrade ocfs2-kmp-64kbUpgrade kernel-kvmsmall-vdsoUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-extraUpgrade dtb-broadcomUpgrade dlm-kmp-rtUpgrade kernel-azure-vdsoUpgrade kernel-syms-rtUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt_debug-develUpgrade kernel-debug-vdsoUpgrade kernel-defaultUpgrade kernel-syms-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-optionalUpgrade kernel-default-vdsoUpgrade kernel-default-base-rebuildUpgrade kernel-rt-vdsoUpgrade cluster-md-kmp-64kbUpgrade gfs2-kmp-azureUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-azureUpgrade kernel-source-vanillaUpgrade dtb-caviumUpgrade dtb-alteraUpgrade dtb-qcom | Dec 5, 2025 | Oct 9, 2025 |
| Ubuntu | — | Upgrade linux-image-gkeop-6.8Upgrade linux-image-gcpUpgrade linux-image-oracle-6.14Upgrade linux-image-ibm-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-generic-64k-6.8Upgrade linux-image-6.8.0-100-fipsUpgrade linux-image-generic-6.8Upgrade linux-image-oem-22.04bUpgrade linux-image-azure-6.8Upgrade linux-image-oracleUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-azure-fips-6.8Upgrade linux-image-nvidiaUpgrade linux-image-6.14.0-36-generic-64kUpgrade linux-image-xilinxUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-azure-6.14Upgrade linux-image-aws-64k-6.8Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-6.14.0-1016-oemUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-gkeUpgrade linux-image-gkeopUpgrade linux-image-generic-64k-6.14Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-aws-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-lowlatencyUpgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-oem-24.04Upgrade linux-image-virtualUpgrade linux-image-oem-22.04Upgrade linux-image-oem-22.04aUpgrade linux-image-fips-6.8Upgrade linux-image-ibmUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-awsUpgrade linux-image-lowlatency-64kUpgrade linux-image-gcp-6.8Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-azure-lts-24.04Upgrade linux-image-fipsUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-genericUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-oem-6.14Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-raspi-realtimeUpgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-6.14.0-1020-gcpUpgrade linux-image-6.14.0-1017-aws-64kUpgrade linux-image-6.14.0-1017-oracleUpgrade linux-image-azure-fipsUpgrade linux-image-nvidia-64kUpgrade linux-image-6.14.0-1017-oracle-64kUpgrade linux-image-virtual-6.14Upgrade linux-image-aws-lts-24.04Upgrade linux-image-gcp-64kUpgrade linux-image-realtime-6.14Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-gke-64kUpgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-gcp-6.14Upgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-oem-22.04cUpgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-azureUpgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-6.14.0-1017-awsUpgrade linux-image-virtual-6.8Upgrade linux-image-oracle-64kUpgrade linux-image-oracle-6.8Upgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-realtime-6.8.1Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-kvmUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-aws-fips-6.8Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-gke-64k-6.8Upgrade linux-image-6.14.0-1017-azureUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-raspiUpgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-generic-6.14Upgrade linux-image-realtimeUpgrade linux-image-raspi-6.8Upgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-raspi-6.14Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-aws-fipsUpgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-6.14.0-36-genericUpgrade linux-image-aws-6.14Upgrade linux-image-generic-64kUpgrade linux-image-6.14.0-1018-raspiUpgrade linux-image-xilinx-6.8Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-6.8.0-1046-awsUpgrade linux-image-6.14.0-1020-gcp-64kUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-aws-64k-6.14Upgrade linux-image-6.14.0-1016-realtimeUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-aws-6.8Upgrade linux-image-gke-6.8Upgrade linux-image-lowlatency-6.8Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-gcp-fipsUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-nvidia-6.8 | Jul 28, 2025 | Jul 19, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 17, 2026 | Jul 19, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub