CVE-2026-64604: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64604 is a locking assertion violation vulnerability in the Linux kernel's KVM/VMX subsystem affecting the CR8 intercept update mechanism. When vmx_update_cr8_intercept() is called during vCPU creation before the vCPU enters guest mode, it incorrectly attempts to retrieve vmcs12 (the nested VM control structure) without satisfying the locking requirements of get_vmcs12(). This results in a kernel lockdep assertion failure and potential denial of service. Affected versions span multiple stable branches: Linux kernel before 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, and 7.1.4. The vulnerability was published on August 6, 2026, with patches available on the same date. The CVSS category is estimated as Medium (GitHub Advisory).

The root cause is an improper locking sequence in vmx_update_cr8_intercept() within arch/x86/kvm/vmx/vmx.c. The function unconditionally calls get_vmcs12(), which enforces a lockdep assertion requiring either the vCPU mutex to be held or the KVM users reference count to be non-zero — conditions not guaranteed during vCPU initialization. The call chain triggering the issue is: kvm_vm_ioctl_create_vcpu() → kvm_arch_vcpu_create() → kvm_vcpu_reset() → kvm_lapic_reset() → apic_update_ppr() → vmx_update_cr8_intercept() → get_vmcs12(). The fix conditionally retrieves vmcs12 only when the vCPU is confirmed to be in guest mode, preventing the assertion violation. No CWE classification has been formally assigned (GitHub Advisory).

Successful exploitation allows a local user with KVM hypervisor access to trigger a kernel warning (lockdep assertion failure) and potential system instability or denial of service. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. The vulnerability affects only systems running nested virtualization (VMX within KVM) on x86 architecture, and exploitation requires local access to the KVM subsystem (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The vulnerability was discovered via syzkaller fuzzing (as indicated by the syz.2.19 process name in the kernel trace). Exploitation requires local access to a KVM-enabled system with nested virtualization support. No EPSS score or CISA KEV catalog entry is currently associated with this CVE (GitHub Advisory).

Patches have been applied to all affected stable kernel branches. Users should upgrade to Linux kernel versions 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, or 7.2-rc1 (or later). The fix modifies vmx_update_cr8_intercept() to retrieve vmcs12 only when the vCPU is confirmed to be in guest mode. As a short-term workaround where patching is not immediately possible, disabling nested virtualization (removing the nested=1 KVM module parameter) would prevent the vulnerable code path from being reached (GitHub Advisory).