In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode When… (CVE-2026-64604)
A vulnerability in the Linux kernel's KVM VMX module related to updating CR8 intercepts has been resolved. The fix ensures that vmcs12 is grabbed only when the virtual CPU (vCPU) is in guest mode, preventing lock dependency assertion warnings. This change addresses a kernel warning without functional impact.
AI Analysis
Technical Summary
The Linux kernel vulnerability CVE-2026-64604 involves the KVM VMX code path where vmcs12 was not conditionally grabbed only if the vCPU was in guest mode during CR8 intercept updates. This caused lockdep assertion warnings during vCPU creation and CR8 intercept updates. The patch modifies the code to grab vmcs12 only when the vCPU is in guest mode, preventing these warnings. The issue does not introduce functional changes or security impact beyond the kernel warning.
Potential Impact
The vulnerability causes kernel warnings related to lock dependency assertions during nested virtualization operations in KVM. There is no indication of functional impact or security compromise from this issue. No known exploits are reported.
Mitigation Recommendations
A fix has been applied in the Linux kernel to address this issue. Users should update to the fixed kernel version once available. No additional mitigation is required as this is a code correctness fix without functional security impact.
In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode When… (CVE-2026-64604)
Description
A vulnerability in the Linux kernel's KVM VMX module related to updating CR8 intercepts has been resolved. The fix ensures that vmcs12 is grabbed only when the virtual CPU (vCPU) is in guest mode, preventing lock dependency assertion warnings. This change addresses a kernel warning without functional impact.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vulnerability CVE-2026-64604 involves the KVM VMX code path where vmcs12 was not conditionally grabbed only if the vCPU was in guest mode during CR8 intercept updates. This caused lockdep assertion warnings during vCPU creation and CR8 intercept updates. The patch modifies the code to grab vmcs12 only when the vCPU is in guest mode, preventing these warnings. The issue does not introduce functional changes or security impact beyond the kernel warning.
Potential Impact
The vulnerability causes kernel warnings related to lock dependency assertions during nested virtualization operations in KVM. There is no indication of functional impact or security compromise from this issue. No known exploits are reported.
Mitigation Recommendations
A fix has been applied in the Linux kernel to address this issue. Users should update to the fixed kernel version once available. No additional mitigation is required as this is a code correctness fix without functional security impact.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-m98c-vhm9-hw9c
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64604"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a74cf9fbf8831d5391b0569
Added to database: 08/06/2026, 18:17:03 UTC
Last enriched: 08/06/2026, 19:11:04 UTC
Last updated: 08/07/2026, 00:41:15 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.