Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)… (CVE-2026-64172)

The Linux kernel vulnerability CVE-2026-64172 concerns the KVM subsystem's handling of AVIC IPI virtualization on Hygon Family 18h CPUs. Due to erratum #1235, hardware may read a stale IsRunning=1 bit during ICR write emulation, causing the kernel to miss the VM-Exit event AVIC_IPI_FAILURE_TARGET_NOT_RUNNING on the sending virtual CPU. This omission prevents KVM from waking blocking target vCPUs, resulting in hung vCPUs and unbounded guest execution delays. The fix disables AVIC IPI virtualization on affected CPUs, ensuring that every non-self IPI triggers a VM-Exit and is properly emulated. The vulnerability affects multiple Linux kernel versions prior to 7.0.0-28.28.1 and numerous specific kernel builds. The vendor advisory from Ubuntu confirms the availability of patches and recommends system updates and reboots to apply the fix.

This vulnerability can cause virtual CPUs to hang and guest virtual machines to experience unbounded delays in execution due to missed VM-Exit events in KVM on affected Hygon Family 18h CPUs. While it does not directly lead to privilege escalation or data corruption, the denial of service impact on virtualized environments can disrupt operations relying on KVM virtualization.

A patch is available and has been released by the vendor. Users should update their Linux kernel to the fixed versions specified in the vendor advisory and reboot their systems to apply the changes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. No additional mitigations are necessary beyond applying the official fix.