CVE-2026-64513: Linux Kernel Privilege Escalation Flaw

CVE-2026-64513 Overview

CVE-2026-64513 is a Linux kernel vulnerability affecting the Kernel-based Virtual Machine (KVM) subsystem on x86 platforms. The flaw resides in the handling of the Task Priority Register (TPR) threshold field within the Virtual Machine Control Structure (VMCS). When the guest's Processor Priority Register (PPR) is updated without a pending deliverable interrupt, KVM fails to recompute the CR8 intercept, leaving a stale TPR_THRESHOLD value. This condition violates the checks defined in Intel SDM section 28.2.1.1 for VM-execution control fields.

Critical Impact
The stale TPR_THRESHOLD can trigger VM entry failures with hardware error 0x7 when KVM runs under nested virtualization on hypervisors that enforce this check, such as Microsoft Hyper-V.

Affected Products

Linux kernel with KVM x86 support
KVM guests running on legacy processors lacking APICv virtual-interrupt delivery
KVM guests running nested under hypervisors that enforce the TPR threshold check

Discovery Timeline

2026-07-25 - CVE-2026-64513 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64513

Vulnerability Analysis

The vulnerability originates in KVM's optimized handling of TPR-below-threshold VM exits. The TPR_THRESHOLD field in the VMCS instructs the processor to generate VM exits when the guest's virtual TPR drops below the specified value. KVM handles these exits in handle_tpr_below_threshold() and can then inject previously masked interrupts.

A prior optimization replaced a KVM_REQ_EVENT request with a direct call to apic_update_ppr(). The optimized path only raises KVM_REQ_EVENT when a deliverable interrupt is pending. When no such interrupt exists, kvm_lapic_update_cr8_intercept() and vmx_update_cr8_intercept() never execute before VM entry. This leaves TPR_THRESHOLD at a stale, higher value than the guest's current virtual TPR.

Root Cause

The root cause is a missing conditional recomputation of the CR8 intercept on PPR update. The apic_update_ppr() function short-circuits when no deliverable interrupt is queued, bypassing the code path that reconciles TPR_THRESHOLD with the guest's virtual TPR. Intel SDM requires that bits 3:0 of TPR_THRESHOLD not exceed bits 7:4 of VTPR when the "use TPR shadow" control is enabled without APICv features.

Attack Vector

The issue manifests as a denial-of-service condition rather than a privilege escalation. On modern processors with APICv and virtual-interrupt delivery, the hardware bypasses the TPR_THRESHOLD check entirely, so the defect stays dormant. On older platforms or under nested virtualization on hypervisors like Hyper-V that enforce the SDM check, VM entry fails with hardware error 0x7. Guest workloads become unable to resume execution.

See the upstream patches at Kernel Git Commit 8c8e8ac, Kernel Git Commit bb365a5, and Kernel Git Commit ff9c4c6 for the implementation-level fix.

Detection Methods for CVE-2026-64513

Indicators of Compromise

KVM VM entry failures reported in the host kernel log with hardware error code 0x7
Guest virtual machines terminating unexpectedly during interrupt-heavy workloads
Nested KVM guests running under Hyper-V exhibiting entry failures after PPR updates

Detection Strategies

Monitor host dmesg and journalctl output for KVM: entry failed, hardware error 0x7 messages
Correlate guest crashes with kernel version and processor APICv support status
Track VM entry failure counters exposed through /sys/kernel/debug/kvm on affected hosts

Monitoring Recommendations

Ingest hypervisor host logs into a centralized log aggregation platform for pattern analysis
Alert on repeated KVM entry failure events across the virtualization fleet
Baseline VM stability metrics on nested virtualization deployments where the SDM check is enforced

How to Mitigate CVE-2026-64513

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the CVE record to affected hosts
Prioritize patching hosts running nested KVM under Hyper-V or other hypervisors that enforce the TPR threshold check
Identify systems using processors without APICv support and schedule kernel updates for those hosts first

Patch Information

The fix calls kvm_lapic_update_cr8_intercept() when apic_update_ppr() does not find a deliverable interrupt and removes now-redundant calls on paths that terminate in apic_update_ppr(). This guarantees every code path updating the guest's PPR also reconciles the CR8 intercept, or TPR_THRESHOLD on VMX and CR8 intercepts on SVM. Refer to Kernel Git Commit ff9c4c6 for the canonical fix and to Kernel Git Commit 8c8e8ac and Kernel Git Commit bb365a5 for stable-tree backports.

Workarounds

Where possible, run KVM directly on bare-metal hardware supporting APICv and virtual-interrupt delivery to bypass the defective code path
Avoid nesting KVM guests under hypervisors known to enforce the SDM TPR threshold check until patches are applied
Restart affected guest VMs after entry failures to restore service while patch deployment is scheduled

bash

# Verify running kernel version and check for the fix
uname -r
grep -R "kvm_lapic_update_cr8_intercept" /usr/src/linux/arch/x86/kvm/ 2>/dev/null

# Inspect host kernel log for KVM entry failures
dmesg | grep -i "entry failed"
journalctl -k | grep -i "hardware error 0x7"