CVE-2026-68093 (GCVE-0-2026-68093)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:58 – Updated: 2026-08-19 16:29
VLAI
Title
KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug If a vCPU stays scheduled out (or blocked) while the last pCPU it ran on goes through a hotplug cycle (online->offline->online), and the vCPU then resumes execution on the same pCPU, then it is possible for it to run with an ASID that has now been assigned to a different vCPU, resulting in stale TLB translations being used. svm_enable_virtualization_cpu() resets asid_generation to 1 and sets next_asid to max_asid + 1 on every CPU online event, including hotplug cycles. Because next_asid starts beyond the pool boundary, the first call to new_asid() after an online event always wraps the pool, incrementing asid_generation to 2 and assigning ASIDs starting from min_asid. Consider two vCPUs from different VMs, vCPU-A pinned to CPU-X holding asid_generation=2 and ASID=N from before the hotplug event: 1. CPU-X goes offline and back online: asid_generation resets to 1, next_asid = max_asid + 1. 2. One or more vCPUs migrate to CPU-X and call new_asid(), wrapping the pool and consuming ASIDs starting from min_asid. Eventually vCPU-B from a different VM is assigned asid_generation=2, ASID=N — the same ASID that vCPU-A held before the hotplug. 3. vCPU-A enters pre_svm_run() on CPU-X: current_vmcb->cpu is unchanged so the migration branch is skipped. Its saved asid_generation=2 matches sd->asid_generation=2, so the generation check silently passes and vCPU-A continues running with ASID=N — the same ASID just freshly assigned to vCPU-B. Both vCPUs from different VMs now run on CPU-X with the same ASID, causing them to share NPT TLB entries and producing stale translations. The collision manifests as a KVM internal error (Suberror: 1, emulation failure). The NPT page fault reports a faulting GPA far outside the VM's physical memory range — a sign of stale TLB translations being used. KVM falls back to instruction emulation, which fails on FPU/XSave instructions (XRSTOR, STMXCSR) that the emulator does not implement. Fix this by incrementing asid_generation instead of resetting it to 1 in svm_enable_virtualization_cpu(). On module load, asid_generation starts at 0 (memset) and the increment produces 1, identical to the old behaviour. On subsequent hotplug cycles the generation advances beyond any value a vCPU previously observed on this CPU, so the generation check in pre_svm_run() reliably forces new_asid() on every vCPU after every hotplug cycle.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 774c47f1d78e373a6bd2964f4e278d1ce26c21cb , < 2028b81321dc757b6875b99c10d908e349c141e2 (git)
Affected: 774c47f1d78e373a6bd2964f4e278d1ce26c21cb , < 60283726f2845bd78b95efbd0e50b93944780477 (git)
Affected: 774c47f1d78e373a6bd2964f4e278d1ce26c21cb , < 7508916b4b55d6f5ecc68cd09774dabd3a6b4440 (git)
Affected: 774c47f1d78e373a6bd2964f4e278d1ce26c21cb , < 0f33b1c457c2199ed130b92cc2ff363a3f7b9415 (git)
Affected: 774c47f1d78e373a6bd2964f4e278d1ce26c21cb , < 6b542d116acecb83a1ca34e8eace304cff6a4ec9 (git)
Affected: 774c47f1d78e373a6bd2964f4e278d1ce26c21cb , < 25f744ffa0c8e799e06250ce2e618367b166b0d4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.21
Unaffected: 0 , < 2.6.21 (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2028b81321dc757b6875b99c10d908e349c141e2",
              "status": "affected",
              "version": "774c47f1d78e373a6bd2964f4e278d1ce26c21cb",
              "versionType": "git"
            },
            {
              "lessThan": "60283726f2845bd78b95efbd0e50b93944780477",
              "status": "affected",
              "version": "774c47f1d78e373a6bd2964f4e278d1ce26c21cb",
              "versionType": "git"
            },
            {
              "lessThan": "7508916b4b55d6f5ecc68cd09774dabd3a6b4440",
              "status": "affected",
              "version": "774c47f1d78e373a6bd2964f4e278d1ce26c21cb",
              "versionType": "git"
            },
            {
              "lessThan": "0f33b1c457c2199ed130b92cc2ff363a3f7b9415",
              "status": "affected",
              "version": "774c47f1d78e373a6bd2964f4e278d1ce26c21cb",
              "versionType": "git"
            },
            {
              "lessThan": "6b542d116acecb83a1ca34e8eace304cff6a4ec9",
              "status": "affected",
              "version": "774c47f1d78e373a6bd2964f4e278d1ce26c21cb",
              "versionType": "git"
            },
            {
              "lessThan": "25f744ffa0c8e799e06250ce2e618367b166b0d4",
              "status": "affected",
              "version": "774c47f1d78e373a6bd2964f4e278d1ce26c21cb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.21"
            },
            {
              "lessThan": "2.6.21",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "2.6.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "2.6.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "2.6.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "2.6.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.21",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug\n\nIf a vCPU stays scheduled out (or blocked) while the last pCPU it ran\non goes through a hotplug cycle (online-\u003eoffline-\u003eonline), and the vCPU\nthen resumes execution on the same pCPU, then it is possible for it to\nrun with an ASID that has now been assigned to a different vCPU,\nresulting in stale TLB translations being used.\n\nsvm_enable_virtualization_cpu() resets asid_generation to 1 and sets\nnext_asid to max_asid + 1 on every CPU online event, including hotplug\ncycles.  Because next_asid starts beyond the pool boundary, the first\ncall to new_asid() after an online event always wraps the pool,\nincrementing asid_generation to 2 and assigning ASIDs starting from\nmin_asid.\n\nConsider two vCPUs from different VMs, vCPU-A pinned to CPU-X holding\nasid_generation=2 and ASID=N from before the hotplug event:\n\n  1. CPU-X goes offline and back online: asid_generation resets to 1,\n     next_asid = max_asid + 1.\n\n  2. One or more vCPUs migrate to CPU-X and call new_asid(), wrapping\n     the pool and consuming ASIDs starting from min_asid.  Eventually\n     vCPU-B from a different VM is assigned asid_generation=2, ASID=N\n     \u2014 the same ASID that vCPU-A held before the hotplug.\n\n  3. vCPU-A enters pre_svm_run() on CPU-X: current_vmcb-\u003ecpu is\n     unchanged so the migration branch is skipped.  Its saved\n     asid_generation=2 matches sd-\u003easid_generation=2, so the generation\n     check silently passes and vCPU-A continues running with ASID=N \u2014\n     the same ASID just freshly assigned to vCPU-B.\n\nBoth vCPUs from different VMs now run on CPU-X with the same ASID,\ncausing them to share NPT TLB entries and producing stale translations.\n\nThe collision manifests as a KVM internal error (Suberror: 1, emulation\nfailure).  The NPT page fault reports a faulting GPA far outside the\nVM\u0027s physical memory range \u2014 a sign of stale TLB translations being\nused.  KVM falls back to instruction emulation, which fails on\nFPU/XSave instructions (XRSTOR, STMXCSR) that the emulator does not\nimplement.\n\nFix this by incrementing asid_generation instead of resetting it to 1\nin svm_enable_virtualization_cpu().  On module load, asid_generation\nstarts at 0 (memset) and the increment produces 1, identical to the\nold behaviour.  On subsequent hotplug cycles the generation advances\nbeyond any value a vCPU previously observed on this CPU, so the\ngeneration check in pre_svm_run() reliably forces new_asid() on every\nvCPU after every hotplug cycle."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:29:15.060Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2028b81321dc757b6875b99c10d908e349c141e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/60283726f2845bd78b95efbd0e50b93944780477"
        },
        {
          "url": "https://git.kernel.org/stable/c/7508916b4b55d6f5ecc68cd09774dabd3a6b4440"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f33b1c457c2199ed130b92cc2ff363a3f7b9415"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b542d116acecb83a1ca34e8eace304cff6a4ec9"
        },
        {
          "url": "https://git.kernel.org/stable/c/25f744ffa0c8e799e06250ce2e618367b166b0d4"
        }
      ],
      "title": "KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68093",
    "datePublished": "2026-08-10T11:58:05.933Z",
    "dateReserved": "2026-07-30T09:28:09.367Z",
    "dateUpdated": "2026-08-19T16:29:15.060Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68093",
      "date": "2026-09-22",
      "epss": "0.00186",
      "percentile": "0.08393"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/x86/kvm/svm/svm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2028b81321dc757b6875b99c10d908e349c141e2",
                    "status": "affected",
                    "version": "774c47f1d78e373a6bd2964f4e278d1ce26c21cb",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "60283726f2845bd78b95efbd0e50b93944780477",
                    "status": "affected",
                    "version": "774c47f1d78e373a6bd2964f4e278d1ce26c21cb",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7508916b4b55d6f5ecc68cd09774dabd3a6b4440",
                    "status": "affected",
                    "version": "774c47f1d78e373a6bd2964f4e278d1ce26c21cb",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0f33b1c457c2199ed130b92cc2ff363a3f7b9415",
                    "status": "affected",
                    "version": "774c47f1d78e373a6bd2964f4e278d1ce26c21cb",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6b542d116acecb83a1ca34e8eace304cff6a4ec9",
                    "status": "affected",
                    "version": "774c47f1d78e373a6bd2964f4e278d1ce26c21cb",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "25f744ffa0c8e799e06250ce2e618367b166b0d4",
                    "status": "affected",
                    "version": "774c47f1d78e373a6bd2964f4e278d1ce26c21cb",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/x86/kvm/svm/svm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.21"
                  },
                  {
                    "lessThan": "2.6.21",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug\n\nIf a vCPU stays scheduled out (or blocked) while the last pCPU it ran\non goes through a hotplug cycle (online-\u003eoffline-\u003eonline), and the vCPU\nthen resumes execution on the same pCPU, then it is possible for it to\nrun with an ASID that has now been assigned to a different vCPU,\nresulting in stale TLB translations being used.\n\nsvm_enable_virtualization_cpu() resets asid_generation to 1 and sets\nnext_asid to max_asid + 1 on every CPU online event, including hotplug\ncycles.  Because next_asid starts beyond the pool boundary, the first\ncall to new_asid() after an online event always wraps the pool,\nincrementing asid_generation to 2 and assigning ASIDs starting from\nmin_asid.\n\nConsider two vCPUs from different VMs, vCPU-A pinned to CPU-X holding\nasid_generation=2 and ASID=N from before the hotplug event:\n\n  1. CPU-X goes offline and back online: asid_generation resets to 1,\n     next_asid = max_asid + 1.\n\n  2. One or more vCPUs migrate to CPU-X and call new_asid(), wrapping\n     the pool and consuming ASIDs starting from min_asid.  Eventually\n     vCPU-B from a different VM is assigned asid_generation=2, ASID=N\n     \u2014 the same ASID that vCPU-A held before the hotplug.\n\n  3. vCPU-A enters pre_svm_run() on CPU-X: current_vmcb-\u003ecpu is\n     unchanged so the migration branch is skipped.  Its saved\n     asid_generation=2 matches sd-\u003easid_generation=2, so the generation\n     check silently passes and vCPU-A continues running with ASID=N \u2014\n     the same ASID just freshly assigned to vCPU-B.\n\nBoth vCPUs from different VMs now run on CPU-X with the same ASID,\ncausing them to share NPT TLB entries and producing stale translations.\n\nThe collision manifests as a KVM internal error (Suberror: 1, emulation\nfailure).  The NPT page fault reports a faulting GPA far outside the\nVM\u0027s physical memory range \u2014 a sign of stale TLB translations being\nused.  KVM falls back to instruction emulation, which fails on\nFPU/XSave instructions (XRSTOR, STMXCSR) that the emulator does not\nimplement.\n\nFix this by incrementing asid_generation instead of resetting it to 1\nin svm_enable_virtualization_cpu().  On module load, asid_generation\nstarts at 0 (memset) and the increment produces 1, identical to the\nold behaviour.  On subsequent hotplug cycles the generation advances\nbeyond any value a vCPU previously observed on this CPU, so the\ngeneration check in pre_svm_run() reliably forces new_asid() on every\nvCPU after every hotplug cycle."
          }
        ],
        "id": "CVE-2026-68093",
        "lastModified": "2026-08-19T17:20:28.353",
        "metrics": {},
        "published": "2026-08-10T13:19:53.303",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0f33b1c457c2199ed130b92cc2ff363a3f7b9415"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2028b81321dc757b6875b99c10d908e349c141e2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/25f744ffa0c8e799e06250ce2e618367b166b0d4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/60283726f2845bd78b95efbd0e50b93944780477"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6b542d116acecb83a1ca34e8eace304cff6a4ec9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7508916b4b55d6f5ecc68cd09774dabd3a6b4440"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T11:15:37+00:00",
      "cve": "CVE-2026-68093",
      "id": "CVE-2026-68093",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "233",
      "product_status:known_not_affected": "44",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68093.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-23T00:21:25Z",
      "cve": "CVE-2026-68093",
      "id": "CVE-2026-68093",
      "initial_release_date": "2026-08-11T23:48:38Z",
      "product_status:first_fixed": "68",
      "product_status:known_affected": "412",
      "product_status:known_not_affected": "282",
      "product_status:recommended": "130",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68093",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68093.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.