CVE-2026-43483: Linux kernel · KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in ba3bca40f9f25c053f69413e5f4a41dd0fd762bf : update Linux kernel when convenient.
Data as of 6 Nov 2026, 16:04 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
Thin evidence
One scorer or none- CISA SSVC
- Exploitation
- No evidence of active exploitation and no public proof of concept
- Automatable
- Attackers cannot reliably automate steps 1–4 of the kill chain
- Technical impact
- Limited control over the software or limited information exposure
CISA SSVC assessment, 2026-11-06.
- Patch
- Available – fixed in ba3bca40f9f25c053f69413e5f4a41dd0fd762bf, a4123fe5d9122eef9852e4921f7cc463420f30d4, 737410b32bd615b321da4fbeda490351b9af5e8b +3
Exploitation evidence
Disclosed: evidence found.
CVE published 13 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
Description
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated Explicitly set/clear CR8 write interception when AVIC is (de)activated to fix a bug where KVM leaves the interception enabled after AVIC is activated. E.g. if KVM emulates INIT=>WFS while AVIC is deactivated, CR8 will remain intercepted in perpetuity. On its own, the dangling CR8 intercept is "just" a performance issue, but combined with the TPR sync bug fixed by commit d02e48830e3f ("KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active"), the danging intercept is fatal to Windows guests as the TPR seen by hardware gets wildly out of sync with reality. Note, VMX isn't affected by the bug as TPR_THRESHOLD is explicitly ignored when Virtual Interrupt Delivery is enabled, i.e. when APICv is active in KVM's world. I.e. there's no need to trigger update_cr8_intercept(), this is firmly an SVM implementation flaw/detail. WARN if KVM gets a CR8 write #VMEXIT while AVIC is active, as KVM should never enter the guest with AVIC enabled and CR8 writes intercepted. [Squash fix to avic_deactivate_vmcb. - Paolo]
References
- git.kernel.org/stable/c/a4123fe5d9122eef9852e4921f7cc463420f30d4 (opens in a new tab)
- git.kernel.org/stable/c/816fa1dfae4532e851b1fe6b2434c753ecbd86c7 (opens in a new tab)
- git.kernel.org/stable/c/01651e7751edbbc0fb4598f8367a3dabcfc8c182 (opens in a new tab)
- git.kernel.org/stable/c/ba3bca40f9f25c053f69413e5f4a41dd0fd762bf (opens in a new tab)
- git.kernel.org/stable/c/737410b32bd615b321da4fbeda490351b9af5e8b (opens in a new tab)
- git.kernel.org/stable/c/87d0f901a9bd8ae6be57249c737f20ac0cace93d (opens in a new tab)