In the Linux kernel, the following vulnerability has been resolved:
KVM: Allow CPU to reschedule while setting per-page memory attributes
When running an SEV-SNP guest with a sufficiently large amount of memory (1TB+), the host can experience CPU soft lockups when running an operation in kvm_vm_set_mem_attributes() to set memory attributes on the whole range of guest memory.
watchdog: BUG: soft lockup - CPU#8 stuck for 26s! [qemu-kvm:6372] CPU: 8 UID: 0 PID: 6372 Comm: qemu-kvm Kdump: loaded Not tainted 6.15.0-rc7.20250520.el9uek.rc1.x86_64 #1 PREEMPT(voluntary) Hardware name: Oracle Corporation ORACLE SERVER E4-2c/Asm,MB Tray,2U,E4-2c, BIOS 78016600 11/13/2024 RIP: 0010:xas_create+0x78/0x1f0 Code: 00 00 00 41 80 fc 01 0f 84 82 00 00 00 ba 06 00 00 00 bd 06 00 00 00 49 8b 45 08 4d 8d 65 08 41 39 d6 73 20 83 ed 06 48 85 c0 <74> 67 48 89 c2 83 e2 03 48 83 fa 02 75 0c 48 3d 00 10 00 00 0f 87 RSP: 0018:ffffad890a34b940 EFLAGS: 00000286 RAX: ffff96f30b261daa RBX: ffffad890a34b9c8 RCX: 0000000000000000 RDX: 000000000000001e RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000018 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffad890a356868 R13: ffffad890a356860 R14: 0000000000000000 R15: ffffad890a356868 FS: 00007f5578a2a400(0000) GS:ffff97ed317e1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f015c70fb18 CR3: 00000001109fd006 CR4: 0000000000f70ef0 PKRU: 55555554 Call Trace: <TASK> xas_store+0x58/0x630 __xa_store+0xa5/0x130 xa_store+0x2c/0x50 kvm_vm_set_mem_attributes+0x343/0x710 [kvm] kvm_vm_ioctl+0x796/0xab0 [kvm] __x64_sys_ioctl+0xa3/0xd0 do_syscall_64+0x8c/0x7a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f5578d031bb Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 2d 4c 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffe0a742b88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000004020aed2 RCX: 00007f5578d031bb RDX: 00007ffe0a742c80 RSI: 000000004020aed2 RDI: 000000000000000b RBP: 0000010000000000 R08: 0000010000000000 R09: 0000017680000000 R10: 0000000000000080 R11: 0000000000000246 R12: 00005575e5f95120 R13: 00007ffe0a742c80 R14: 0000000000000008 R15: 00005575e5f961e0
While looping through the range of memory setting the attributes, call cond_resched() to give the scheduler a chance to run a higher priority task on the runqueue if necessary and avoid staying in kernel mode long enough to trigger the lockup.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-livepatch-6.12.40-63.114Upgrade kernel6.12-libbpf-debuginfoUpgrade kernel6.12-libbpf-develUpgrade perf6.12Upgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-headersUpgrade kernel6.12Upgrade kernel6.12-debuginfo-common-x86_64Upgrade perf6.12-debuginfoUpgrade kernel6.12-toolsUpgrade bpftool6.12Upgrade bpftool6.12-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade kernel6.12-libbpf-staticUpgrade kernel6.12-tools-debuginfoUpgrade kernel6.12-tools-develUpgrade kernel6.12-libbpfUpgrade python3-perf6.12Upgrade kernel6.12-modules-extraUpgrade kernel6.12-debuginfoUpgrade kernel6.12-develUpgrade kernel6.12-modules-extra-common | Oct 16, 2025 | Aug 16, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Suse | — | Upgrade ocfs2-kmp-defaultUpgrade dtb-armUpgrade cluster-md-kmp-64kbUpgrade kernel-source-vanillaUpgrade kernel-default-livepatch-develUpgrade kernel-azureUpgrade kernel-debug-vdsoUpgrade kernel-obs-buildUpgrade kernel-rt-extraUpgrade reiserfs-kmp-rtUpgrade kernel-defaultUpgrade dlm-kmp-rtUpgrade dtb-rockchipUpgrade kernel-64kb-extraUpgrade ocfs2-kmp-azureUpgrade kernel-rt-optionalUpgrade kselftests-kmp-defaultUpgrade dtb-allwinnerUpgrade kernel-kvmsmall-vdsoUpgrade dtb-qcomUpgrade kernel-azure-develUpgrade kernel-docsUpgrade dlm-kmp-defaultUpgrade dtb-nvidiaUpgrade dtb-sprdUpgrade kernel-default-baseUpgrade kernel-default-base-rebuildUpgrade kernel-rt-livepatchUpgrade kernel-rt-vdsoUpgrade kselftests-kmp-rtUpgrade gfs2-kmp-defaultUpgrade kselftests-kmp-azureUpgrade gfs2-kmp-azureUpgrade reiserfs-kmp-azureUpgrade dlm-kmp-azureUpgrade dtb-caviumUpgrade kernel-rtUpgrade kernel-rt_debug-develUpgrade kernel-source-rtUpgrade reiserfs-kmp-64kbUpgrade dlm-kmp-64kbUpgrade kernel-64kb-optionalUpgrade dtb-freescaleUpgrade dtb-amdUpgrade kernel-macrosUpgrade kernel-rt_debug-vdsoUpgrade dtb-broadcomUpgrade dtb-exynosUpgrade cluster-md-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-syms-azureUpgrade dtb-renesasUpgrade kernel-azure-vdsoUpgrade kernel-kvmsmallUpgrade kernel-rt-develUpgrade kernel-default-extraUpgrade gfs2-kmp-rtUpgrade dtb-lgUpgrade dtb-amazonUpgrade kselftests-kmp-64kbUpgrade kernel-64kbUpgrade kernel-default-vdsoUpgrade kernel-64kb-develUpgrade kernel-devel-rtUpgrade kernel-develUpgrade kernel-default-livepatchUpgrade dtb-hisiliconUpgrade cluster-md-kmp-azureUpgrade kernel-rt_debugUpgrade dtb-apmUpgrade kernel-rt-livepatch-develUpgrade kernel-sourceUpgrade kernel-devel-azureUpgrade dtb-socionextUpgrade kernel-zfcpdumpUpgrade kernel-syms-rtUpgrade kernel-kvmsmall-develUpgrade kernel-default-develUpgrade dtb-appleUpgrade dtb-amlogicUpgrade dtb-marvellUpgrade kernel-obs-qaUpgrade kernel-debug-develUpgrade kernel-debugUpgrade gfs2-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-azure-optionalUpgrade kernel-azure-extraUpgrade dtb-mediatekUpgrade dtb-alteraUpgrade cluster-md-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade kernel-symsUpgrade kernel-docs-htmlUpgrade kernel-default-optionalUpgrade dtb-xilinx | Dec 5, 2025 | Sep 18, 2025 |
| Ubuntu | — | Upgrade linux-image-generic-64k-6.14Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.14.0-36-genericUpgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-6.14.0-1020-gcp-64kUpgrade linux-image-gcp-6.14Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-raspi-6.14Upgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-awsUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-realtimeUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-gkeUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-raspi-6.8Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-azure-6.14Upgrade linux-image-aws-fipsUpgrade linux-image-aws-6.8Upgrade linux-image-gke-64kUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-realtime-6.8.1Upgrade linux-image-gcp-fipsUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-aws-64k-6.14Upgrade linux-image-generic-6.14Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.14.0-1017-oracleUpgrade linux-image-6.14.0-36-generic-64kUpgrade linux-image-virtualUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-fips-6.8Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-nvidia-64kUpgrade linux-image-ibm-6.8Upgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-generic-6.8Upgrade linux-image-oem-22.04bUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-generic-64k-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-xilinxUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-nvidiaUpgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-oem-6.14Upgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-aws-64k-6.8Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-oracleUpgrade linux-image-azure-6.8Upgrade linux-image-gcp-6.8Upgrade linux-image-lowlatencyUpgrade linux-image-gkeop-6.8Upgrade linux-image-lowlatency-64kUpgrade linux-image-realtime-6.14Upgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.14.0-1016-realtimeUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-fipsUpgrade linux-image-aws-lts-24.04Upgrade linux-image-aws-6.14Upgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-6.14.0-1017-oracle-64kUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-1046-awsUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-virtual-6.8Upgrade linux-image-oem-22.04cUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-lowlatency-6.8Upgrade linux-image-gke-64k-6.8Upgrade linux-image-gcp-64kUpgrade linux-image-azureUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-6.14.0-1017-azureUpgrade linux-image-gkeopUpgrade linux-image-xilinx-6.8Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-oracle-6.14Upgrade linux-image-6.14.0-1017-awsUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.14.0-1020-gcpUpgrade linux-image-genericUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.14.0-1018-raspiUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-raspiUpgrade linux-image-oracle-6.8Upgrade linux-image-nvidia-lowlatency-6.8 | Nov 25, 2025 | Nov 21, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub