CVE-2026-64172

CVE-2026-64172

High · published July 19, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
8.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)

Hygon Family 18h CPUs are derived from AMD Family 17h (Zen1) silicon and

share the same erratum #1235: hardware may read a stale IsRunning=1 bit

during ICR write emulation and silently fail to generate an

AVIC_IPI_FAILURE_TARGET_NOT_RUNNING VM-Exit on the sending vCPU.

The absence of the VM-Exit causes KVM to miss the required wakeup of

blocking target vCPUs, leading to hung vCPUs and unbounded delays in

guest execution.

Extend the existing AMD Family 17h erratum #1235 workaround to also cover

Hygon Family 18h. With IPI virtualization disabled, KVM never sets

IsRunning=1 in the Physical ID table, so every non-self IPI generates a

VM-Exit and is correctly emulated.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00195 · 8.7th percentile
Published
2026-07-19T20:17Z
Affected products (6)
ProductVersionsFixed in
linux/linux_kernel≥ 6.17, < 6.18.346.18.34
linux/linux_kernel≥ 6.19, < 7.0.117.0.11
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (3)
EPSS history
Timeline
  • 19 JUL 15:40Z
    KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)
    cvelistv5