CVE-2026-72286

HighCVSS 8.8/10Last modified Oct 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs

The intra-host migration/mirroring feature is not fully implemented for SEV-SNP VMs. The proper migration requires additional SNP-specific state such as guest_req_mutex, guest_req_buf, and guest_resp_buf to be transferred or initialized on the destination.

The SNP VM mirroring requires vmsa features to be copied as well otherwise ASID would be bound to SNP range while VM is detected as a SEV VM.

Reject SNP source VMs in migration/mirroring until proper SNP state transfer is implemented.

[sean: let lines poke past 80 chars, tag for stable]

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 1dfe571c12cf99244b933208fb77f29471ded677, < b70404b89daad5f9f33f7ac640b1065cba639935; >= 1dfe571c12cf99244b933208fb77f29471ded677, < ba06690b28be950bd46d938d9b919c4024292627; >= 1dfe571c12cf99244b933208fb77f29471ded677, < d2f9df3b615ca0cd45899c090366945528186052; >= 1dfe571c12cf99244b933208fb77f29471ded677, < 6ee4140788234a6fabf59e6a50e38cdb936008cd
LinuxLinux6.11

References

Timeline

Published
Aug 15, 2026
Last modified
Oct 16, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-722877.8In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" CVE-2026-722889.3In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Handle race between interrupt affinity change and LPICVE-2026-722899.3In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Check the interrupt is still ours before migrating itCVE-2026-72296.3A vulnerability was found in code-projects Coaching Management System 1.0. This affects an unknown function of the file /cims/modules/admin/CVE-2026-72290In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix GISC refcount leak on AIF enable failure kvm_s390_CVE-2026-722919.3In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix unlikely race in try_get_locked_pte() Fix an unlikely rCVE-2026-72292In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Initialize KVM_S390_GET_CMMA_BITS memory kvm_s390_get_cmma_CVE-2026-72293In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: Add missing radix_tree_preload() in _gaccess_shadow_faCVE-2026-722948.8In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() FunctCVE-2026-722958.8In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate irqchip index in irqfd routing Sashiko reportCVE-2026-722969.1In the Linux kernel, the following vulnerability has been resolved: net: ife: require ETH_HLEN to be pullable in ife_decode() ife decode mCVE-2026-722977.1In the Linux kernel, the following vulnerability has been resolved: net: atm: reject out-of-range traffic classes in QoS validation Reject
CVE-2026-72286: High severity, CVSS 8.8 | Vulnix