CVE-2026-72284

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The flaw is reached when malicious guest code in an x86 KVM VM races paravirtual EOI state, causing kvm_lapic_sync_from_vapic() to run on VM exit via KVM_RUN; this requires local guest execution on a KVM host, not remote network packets to the host kernel.

AC:LAttack complexity, low

The attacker controls both sides of the race: guest wrmsr to MSR_KVM_PV_EOI_EN disables PV EOI while KVM_APIC_PV_EOI_PENDING remains set, then any VM exit reliably hits BUG_ON; optional guest memory unmapping can also force pv_eoi_get_user() failure without uncontrollable host timing.

PR:NPrivileges required, none

No host root or init-namespace capabilities are required; exploitation needs only code execution inside an assigned KVM guest with KVM_FEATURE_PV_EOI (default on Linux/QEMU guests), typical for any cloud VM tenant without privileged host access.

UI:NUser interaction, none

No victim user or administrator action is required beyond the attacker operating their own guest workload; triggering is fully automated via guest MSR writes and deliberate VM exits that drive the KVM_RUN return path.

S:CScope, changed

A guest-triggered BUG_ON in host KVM LAPIC code panics the physical host kernel and denies all co-resident VMs, crossing the guest-to-host KVM virtualization security boundary even though exploitation is denial-of-service rather than memory corruption.

C:NConfidentiality impact, none

The failure mode is BUG_ON in apic_sync_pv_eoi_from_guest with no out-of-bounds access, use-after-free, or memory corruption; it is a deterministic assertion panic without an information disclosure or memory-read primitive.

I:NIntegrity impact, none

No guest-controlled kernel memory write or control-flow hijack occurs; the host kernel aborts via BUG_ON before any exploitable state mutation beyond crashing the host, and the bug is a stale pending-bit assertion not type confusion.

A:HAvailability impact, high

BUG_ON in kvm_lapic_sync_from_vapic provokes a host kernel oops/panic during KVM_RUN VM-exit processing, immediately denying availability of the hypervisor and every VM on the affected x86 KVM host; the attack is repeatable while PV EOI remains enabled for the guest.