Linux Kernel: hv_apicid_to_vp_index() PerCPU Page Use Crash in SEVSNP CoCo VM
CVE-2026-99258 Published on November 3, 2026
x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()
In the Linux kernel, the following vulnerability has been resolved:
x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()
hv_apicid_to_vp_index() currently uses the per-cpu hypercall input
and output pages. This function is called when running in VTL2 and
when running in an SEV-SNP CoCo VM with no paravisor. In the former
case, the output page is allocated, but in the latter case it is
not, so the hypervisor stores the output VP index in memory that has
not been allocated by the guest.
Fix this by using the input page for both input and output. The
hypercall has very small input and output, so sharing the same
page for both is straightforward. An alternative fix is to
allocate the per-cpu output page when running in an SEV-SNP CoCo
guest, but this uses significantly more memory, particularly
with larger vCPUs counts.
Products Associated with CVE-2026-99258
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 3d12349ade541eefde0e71bf5c4aa7aa04c52a79 and below bdba5f1b8bd0d18b1df61f769b559ed272902489 is affected.
- Version 86c48271e0d60c82665e9fd61277002391efcef7 and below 2b561786c9076a892ef8b8f416c9828bc87ed44f is affected.
- Version 86c48271e0d60c82665e9fd61277002391efcef7 and below bc8ca0f4769627ae7d04e7ffdbd20de4f27a9bf9 is affected.
- Version 86c48271e0d60c82665e9fd61277002391efcef7 and below 7b74c117e2aac78e0f723e1c9c3644451c56b0d9 is affected.
- Version cb002d6c8f06d6061e84b2109cb84416107a9fb9 is affected.
- Version 6.12.41 and below 6.12.115 is affected.
- Version 6.15.3 and below 6.16 is affected.
- Version 6.16 is affected.
- Before 6.16 is unaffected.
- Version 6.12.115, <= 6.12.* is unaffected.
- Version 6.18.59, <= 6.18.* is unaffected.
- Version 7.2.13, <= 7.2.* is unaffected.
- Version 7.3, <= * is unaffected.