CVE-2026-23005: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23005 is a denial-of-service vulnerability in the Linux kernel's x86 FPU (floating-point unit) handling within KVM (Kernel Virtual Machine), caused by improper management of XSTATE_BV and XFD (Extended Feature Disable) register state during guest XSAVE operations. When XSTATE_BV[i]=1 is set while XFD[i]=1, the kernel executes XRSTOR with conflicting state, triggering a #NM (Device Not Available) exception that panics the host kernel. The vulnerability was disclosed on January 25, 2026, and affects Linux kernel versions 5.17.1 through 6.1.161, 6.2 through 6.6.121, 6.7 through 6.12.66, and 6.13 through 6.18.6, as well as pre-release 6.19-rc builds (Red Hat Advisory, Red Hat Bugzilla). It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory).

The root cause is improper state management (CWE-667 / improper locking/synchronization of shared resources) in the Linux kernel's x86 FPU subsystem when handling KVM guest state. Two distinct trigger paths exist: (1) a guest VM executes WRMSR(MSR_IA32_XFD) to set XFD[i]=1, and a host interrupt fires kernel_fpu_begin() before fpu_update_guest_xfd() clears the corresponding XSTATE_BV bit; (2) userspace calls the KVM_SET_XSAVE ioctl to directly stuff conflicting XSTATE_BV[i]=1 values while XFD[i]=1 is set. In both cases, when the kernel subsequently executes XRSTOR with the guest's XFD MSR active, the conflicting XSTATE_BV causes a #NM exception in restore_fpregs_from_fpstate(), which is not handled gracefully and results in a kernel panic. The fix clears XFD-disabled feature bits in XSTATE_BV whenever XFD[i]=1, consistent with Intel SDM behavior where XSAVE saves XSTATE_BV[i]=0 for XFD-disabled components (Red Hat Bugzilla).

Successful exploitation results in an immediate host kernel panic (kernel crash), causing a complete denial of service for the hypervisor host and all guest VMs running on it. The impact is limited to availability — there is no confidentiality or integrity impact. Because the crash affects the host kernel, all virtual machines on the affected hypervisor node are simultaneously disrupted, making this particularly impactful in multi-tenant cloud or virtualization environments (Red Hat Advisory, Red Hat Bugzilla).

1. Gain guest VM access: Obtain access to a guest VM running on a vulnerable Linux KVM host (kernel versions 5.17.1–6.1.161, 6.2–6.6.121, 6.7–6.12.66, or 6.13–6.18.6), or obtain low-privileged access to the host with permission to invoke KVM ioctls.
2. Path A — WRMSR race condition: From within the guest VM, execute WRMSR(MSR_IA32_XFD) to set XFD[i]=1 (e.g., bit 18 for AMX tile state). Time this so that a host interrupt triggers kernel_fpu_begin() before the vmexit handler's call to fpu_update_guest_xfd() clears the corresponding XSTATE_BV bit, creating a race condition.
3. Path B — KVM_SET_XSAVE ioctl: From a userspace process on the host with access to the KVM device, use the KVM_SET_XSAVE ioctl to write guest XSAVE state with XSTATE_BV[i]=1 set for a feature that has XFD[i]=1 (i.e., a feature disabled via XFD).
4. Trigger kernel panic: When the kernel subsequently executes XRSTOR with the guest's XFD MSR active and the conflicting XSTATE_BV, a #NM exception is raised in restore_fpregs_from_fpstate(), which is not handled gracefully and causes the host kernel to panic, crashing the hypervisor and all hosted VMs (Red Hat Bugzilla).

• Logs: Kernel panic messages in /var/log/kern.log or dmesg containing exc_device_not_available and a call trace through restore_fpregs_from_fpstate, switch_fpu_return, and kvm_arch_vcpu_ioctl_run [kvm].
• Logs: Warning messages from arch/x86/kernel/traps.c:1524 referencing exc_device_not_available+0x101/0x110 associated with a KVM guest process.
• Logs: Kernel oops or panic traces showing kvm_vcpu_ioctl, __x64_sys_ioctl, and do_syscall_64 in the call stack, indicating the crash originated from a KVM ioctl call.
• Process: Unexpected termination of KVM guest processes (e.g., qemu-kvm, qemu-system-x86_64) coinciding with host kernel crash events.
• System: Unexpected host system reboots or unplanned downtime on KVM hypervisor nodes, particularly on systems running AMX (Advanced Matrix Extensions) workloads in guest VMs (Red Hat Bugzilla).

Upgrade the Linux kernel to a patched version: 6.1.162 or later, 6.6.122 or later, 6.12.67 or later, or 6.18.7 or later. Patches are available via five upstream kernel commits: 1e2848bda819, b45f721775947, b5995c01ba53d, eea6f395ca502, and f577508cc8a0a (Red Hat Bugzilla). Distribution-specific updates are available from Ubuntu (USN-8278-1, USN-8289-1, USN-8296-1, USN-8278-2, USN-8296-2, USN-8289-2, USN-8393-1) and Oracle Enterprise Linux. As a workaround where patching is not immediately possible, restrict guest VM access and KVM_SET_XSAVE ioctl permissions to trusted users only, and avoid enabling AMX or other XFD-managed features in guest VMs on unpatched hosts.