CVE-2026-68093 Overview
CVE-2026-68093 is a Linux kernel vulnerability in the KVM SVM (Kernel-based Virtual Machine Secure Virtual Machine) subsystem. The flaw allows Address Space Identifier (ASID) collisions between virtual CPUs (vCPUs) belonging to different virtual machines after a physical CPU (pCPU) hotplug cycle. When a vCPU remains scheduled out while its last pCPU goes through an online-offline-online transition, the vCPU can resume execution using an ASID that has been reassigned to a different VM. This condition produces stale Nested Page Table (NPT) Translation Lookaside Buffer (TLB) entries shared across VM boundaries.
Critical Impact
Cross-VM TLB translation reuse leads to KVM internal errors, emulation failures on FPU/XSave instructions, and potential guest memory integrity issues on AMD SVM hosts.
Affected Products
- Linux kernel builds enabling KVM SVM on AMD processors prior to the fix commits
- Stable kernel branches referenced by commits 0f33b1c, 25f744f, 6028372, 6b542d1, and 7508916
- Hypervisor deployments performing CPU hotplug operations on AMD-based hosts
Discovery Timeline
- 2026-08-10 - CVE-2026-68093 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68093
Vulnerability Analysis
The defect resides in svm_enable_virtualization_cpu(), which executes on every CPU online event. The function resets asid_generation to 1 and sets next_asid to max_asid + 1. Because next_asid starts beyond the pool boundary, the first call to new_asid() after an online event wraps the pool, increments asid_generation to 2, and assigns ASIDs starting from min_asid.
Consider a vCPU-A pinned to CPU-X holding asid_generation=2 and ASID=N before a hotplug event. After CPU-X goes offline and returns online, asid_generation resets to 1. New vCPUs migrating to CPU-X call new_asid(), wrap the pool, and consume ASIDs from min_asid. Eventually vCPU-B from a different VM is assigned asid_generation=2, ASID=N, matching the value vCPU-A previously held.
When vCPU-A subsequently enters pre_svm_run() on CPU-X, current_vmcb->cpu is unchanged so the migration branch is skipped. Its saved asid_generation=2 matches sd->asid_generation=2, so the generation check silently passes and vCPU-A continues running with the same ASID as vCPU-B.
Root Cause
The root cause is the unconditional reset of asid_generation to 1 during CPU online handling. This reset destroys the monotonic property the generation counter is designed to provide, allowing a stale generation value stored on a scheduled-out vCPU to falsely appear current after a hotplug cycle.
Attack Vector
The vulnerability is a race condition triggered by legitimate CPU hotplug operations on AMD SVM hosts running multiple VMs. Exploitation does not require an attack payload; the collision manifests as a KVM internal error with Suberror: 1 emulation failure. NPT page faults report faulting Guest Physical Addresses (GPA) far outside the VM's memory range, indicating stale TLB translations. KVM falls back to instruction emulation, which fails on XRSTOR and STMXCSR instructions the emulator does not implement.
The vulnerability mechanism is described in the upstream commits. See the Kernel Git Commit 6028372 for the authoritative fix description.
Detection Methods for CVE-2026-68093
Indicators of Compromise
- KVM internal error messages in dmesg reporting Suberror: 1 emulation failures on AMD SVM hosts
- NPT page fault log entries reporting faulting GPAs outside the guest's configured physical memory range
- Guest kernel crashes or emulation errors on XRSTOR, STMXCSR, and other FPU/XSave instructions following a host CPU hotplug event
Detection Strategies
- Correlate host CPU hotplug events with subsequent KVM emulation failures across running VMs
- Track kernel version and confirm whether patches referenced in the fix commits are applied
- Audit hypervisor logs for repeated ASID-related anomalies after maintenance cycles that toggle pCPU state
Monitoring Recommendations
- Monitor /var/log/kern.log and journalctl -k for KVM internal error strings on AMD hosts
- Alert on unexpected guest VM instability that coincides with cpu offline/cpu online events
- Track vCPU migration patterns and ASID exhaustion counters exposed via kvm_stat or tracepoints
How to Mitigate CVE-2026-68093
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the fix commits to all AMD SVM hypervisor hosts
- Avoid performing CPU hotplug operations on production AMD KVM hosts until the fix is deployed
- Restart affected VMs after any hotplug cycle to force fresh ASID assignment
Patch Information
The fix increments asid_generation instead of resetting it to 1 in svm_enable_virtualization_cpu(). On module load, asid_generation starts at 0 through memset, and the increment produces 1, preserving original behavior. On subsequent hotplug cycles, the generation advances beyond any value a vCPU previously observed, so the generation check in pre_svm_run() reliably forces new_asid() on every vCPU after every hotplug cycle. Patches are available in commits 0f33b1c, 25f744f, 6028372, 6b542d1, and 7508916.
Workarounds
- Disable CPU hotplug on affected hosts by pinning pCPUs online through system configuration until patches are applied
- Reboot the host after hotplug operations rather than resuming existing guests to invalidate all cached ASID state
- Pin vCPUs to pCPUs that will not undergo hotplug cycles during the VM lifetime
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
