Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-43483— KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在AVIC激活时未正确设置或清除CR8写入拦截，可能导致Windows客户机中TPR与硬件严重不同步。

AI Predicted 6.6 Difficulty: Moderate EPSS 0.16% · P5

Possible ATT&CK Techniques 1 AI

T1498 · Network Denial of Service

Affected Version Matrix 14

VendorProduct Version RangeStatus
Linux Linux 3bbf3565f48ce3999b5a12cde946f81bd4475312< a4123fe5d9122eef9852e4921f7cc463420f30d4 affected
3bbf3565f48ce3999b5a12cde946f81bd4475312< 816fa1dfae4532e851b1fe6b2434c753ecbd86c7 affected
3bbf3565f48ce3999b5a12cde946f81bd4475312< 01651e7751edbbc0fb4598f8367a3dabcfc8c182 affected
3bbf3565f48ce3999b5a12cde946f81bd4475312< ba3bca40f9f25c053f69413e5f4a41dd0fd762bf affected
3bbf3565f48ce3999b5a12cde946f81bd4475312< 737410b32bd615b321da4fbeda490351b9af5e8b affected
3bbf3565f48ce3999b5a12cde946f81bd4475312< 87d0f901a9bd8ae6be57249c737f20ac0cace93d affected
4.7 affected
< 4.7 unaffected
… +6 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-43483

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated Explicitly set/clear CR8 write interception when AVIC is (de)activated to fix a bug where KVM leaves the interception enabled after AVIC is activated. E.g. if KVM emulates INIT=>WFS while AVIC is deactivated, CR8 will remain intercepted in perpetuity. On its own, the dangling CR8 intercept is "just" a performance issue, but combined with the TPR sync bug fixed by commit d02e48830e3f ("KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active"), the danging intercept is fatal to Windows guests as the TPR seen by hardware gets wildly out of sync with reality. Note, VMX isn't affected by the bug as TPR_THRESHOLD is explicitly ignored when Virtual Interrupt Delivery is enabled, i.e. when APICv is active in KVM's world. I.e. there's no need to trigger update_cr8_intercept(), this is firmly an SVM implementation flaw/detail. WARN if KVM gets a CR8 write #VMEXIT while AVIC is active, as KVM should never enter the guest with AVIC enabled and CR8 writes intercepted. [Squash fix to avic_deactivate_vmcb. - Paolo]
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在AVIC激活时未正确设置或清除CR8写入拦截，可能导致Windows客户机中TPR与硬件严重不同步。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 3bbf3565f48ce3999b5a12cde946f81bd4475312 ~ a4123fe5d9122eef9852e4921f7cc463420f30d4 -
Linux Linux 4.7 -

II. Public POCs for CVE-2026-43483

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-43483

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-43483 (6)

Same Patch Batch · Linux · 2026-05-13 · 14 CVEs total

CVE-2026-43481 7.8 HIGH net-shapers: don't free reply skb after genlmsg_reply()
CVE-2026-43476 7.8 HIGH iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
CVE-2026-43489 liveupdate: luo_file: remember retrieve() status
CVE-2026-43487 ata: libata-core: Disable LPM on ST1000DM010-2EP102
CVE-2026-43488 usb: xhci: Prevent interrupt storm on host controller error (HCE)
CVE-2026-43485 nouveau/gsp: drop WARN_ON in ACPI probes
CVE-2026-43486 arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults
CVE-2026-43484 mmc: core: Avoid bitfield RMW for claim/retune flags
CVE-2026-43482 sched_ext: Disable preemption between scx_claim_exit() and kicking helper work
CVE-2026-43480 ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition
CVE-2026-43479 net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
CVE-2026-43477 drm/i915/vrr: Configure VRR timings after enabling TRANS_DDI_FUNC_CTL
CVE-2026-43478 ASoC: codecs: rt1011: Use component to get the dapm context in spk_mode_put

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-43483

No comments yet

Leave a comment