CVE-2026-64284: KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits

Move the handling of fastpath userspace exits into vendor code to ensure
KVM runs vendor specific operations that need to run before userspace gains
control of the vCPU.  E.g. for VMX (and soon to be for SVM as well), KVM
needs to flush the PML buffer prior to exiting to userspace, otherwise any
memory written by the final KVM_RUN might never be flagged as dirty.

Note, waiting to snapshot CR0 and CR3 until svm_handle_exit() is flawed in
general, as that risks consuming stale state in a fastpath handler.  That
will be addressed in a future change.

The Linux kernel CVE team has assigned CVE-2026-64284 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.12 with commit f7f39c50edb9d336274371953275e0d3503b9b75 and fixed in 6.12.96 with commit b3436d9b9b1affe1c3191ac9831308923f5f03c3
	Issue introduced in 6.12 with commit f7f39c50edb9d336274371953275e0d3503b9b75 and fixed in 6.18.39 with commit 4ad73ef0e7966ecfe67de0060537b4cb14d9acd4
	Issue introduced in 6.12 with commit f7f39c50edb9d336274371953275e0d3503b9b75 and fixed in 7.1.4 with commit f2ca2b5326211bd38490f0497eb583721ce0bbc0
	Issue introduced in 6.12 with commit f7f39c50edb9d336274371953275e0d3503b9b75 and fixed in 7.2-rc1 with commit 0ffedf43910e44b76c2c1db4e9fbf12b268190c1

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64284
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/x86/kvm/svm/svm.c
	arch/x86/kvm/vmx/vmx.c
	arch/x86/kvm/x86.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b3436d9b9b1affe1c3191ac9831308923f5f03c3
	https://git.kernel.org/stable/c/4ad73ef0e7966ecfe67de0060537b4cb14d9acd4
	https://git.kernel.org/stable/c/f2ca2b5326211bd38490f0497eb583721ce0bbc0
	https://git.kernel.org/stable/c/0ffedf43910e44b76c2c1db4e9fbf12b268190c1