CVE-2026-89927: Linux Kernel Hyper-V Timer DoS Vulnerability

CVE-2026-89927 Overview

CVE-2026-89927 is a Linux kernel vulnerability in the KVM x86 Hyper-V synthetic timer (stimer) emulation code. Userspace or a guest can program a Hyper-V synthetic timer with a HV_X64_MSR_STIMERi_COUNT value close to U64_MAX, causing an integer overflow in the deadline calculation. The overflow arms an hrtimer with a deadline in the past, which fires immediately and re-arms itself in a tight loop. The resulting livelock prevents the affected CPU from making forward progress, starves RCU grace-period kthreads, and triggers RCU stalls that can escalate to out-of-memory conditions.

Critical Impact
A local user with the ability to issue KVM ioctls or a guest able to write Hyper-V MSRs can induce a CPU livelock in the host kernel, causing denial of service through RCU stalls and potential OOM.

Affected Products

Linux kernel with KVM x86 Hyper-V synthetic interrupt controller (SynIC) enabled
Host systems exposing Hyper-V enlightenments to KVM guests
Stable branches receiving fixes across the eight referenced commits

Discovery Timeline

2026-09-16 - CVE-2026-89927 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89927

Vulnerability Analysis

Hyper-V's SynIC exposes four per-vCPU synthetic timers to the guest, emulated by KVM. Each timer is programmed through HV_X64_MSR_STIMERi_CONFIG and HV_X64_MSR_STIMERi_COUNT. The COUNT MSR holds either an absolute expiration time or a periodic interval, expressed in 100ns ticks. Both the guest via WRMSR and the host via KVM_SET_MSRS can write these MSRs.

When the timer is enabled, stimer_start() translates COUNT into an absolute monotonic deadline and arms an hrtimer. The translation uses ktime_add_ns(ktime_now, 100 * (stimer->exp_time - time_now)). Values close to U64_MAX overflow this arithmetic, producing a deadline in the past. This maps to an integer overflow flaw [CWE-190] in kernel timer arithmetic.

Root Cause

The root cause is the absence of bounds checking on stimer->exp_time before performing the deadline conversion. The hrtimer fires immediately because its deadline lies in the past. The callback raises KVM_REQ_HV_STIMER, expecting kvm_hv_process_stimers() to disable the timer. However, stimer_expiration() compares the KVM reference counter against the huge unpatched exp_time, so the disable branch is never taken.

Attack Vector

After each KVM_RUN, vcpu_enter_guest() consumes the pending request and re-arms the timer through stimer_start(), which fires again immediately. kvm_vcpu_exit_request() then observes kvm_request_pending() returning true and aborts the guest entry. vcpu_run() loops back into vcpu_enter_guest(), restarting the cycle without any yield point. A SCHED_FIFO task in this loop starves the rcu_preempt kthread, producing the RCU stall traces seen by syzkaller. The attack requires local access and no privileges beyond the ability to issue KVM MSR operations or write guest MSRs.

Detection Methods for CVE-2026-89927

Indicators of Compromise

Kernel log entries containing rcu: INFO: rcu_preempt detected stalls on CPUs/tasks on hosts running KVM with Hyper-V enlightenments enabled.
hrtimer_interrupt and __hrtimer_run_queues frames dominating stack traces of a single vCPU thread with no forward progress.
Repeated KVM_REQ_HV_STIMER request handling on the same vCPU without corresponding guest advancement.

Detection Strategies

Monitor host dmesg and journalctl -k for rcu_preempt kthread starved messages correlated with QEMU or other KVM userspace processes.
Track CPU utilization anomalies where a QEMU vCPU thread pins a host CPU at 100% while the guest makes no measurable progress.
Audit KVM_SET_MSRS calls that write HV_X64_MSR_STIMER0_COUNT through HV_X64_MSR_STIMER3_COUNT with values near U64_MAX.

Monitoring Recommendations

Enable kernel softlockup and hung_task detectors on virtualization hosts to surface livelocks early.
Ingest host kernel logs into a centralized logging pipeline and alert on RCU stall signatures tied to KVM call stacks.
Correlate guest MSR write telemetry with host CPU pressure metrics to identify malicious or misbehaving guests.

How to Mitigate CVE-2026-89927

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the git.kernel.org stable commits linked below to all KVM hypervisor hosts.
Restrict access to /dev/kvm and KVM ioctl surfaces to trusted virtualization management processes only.
Treat untrusted guests that request Hyper-V enlightenments as capable of triggering host denial of service until patched.

Patch Information

The fix clamps the synthetic timer deadline to prevent integer overflow when translating exp_time into an hrtimer deadline. Patches are distributed across the stable trees in the following commits: Kernel Git Commit 0ca49fb, Kernel Git Commit 3097582, Kernel Git Commit 6195472, Kernel Git Commit 6a8ba92, Kernel Git Commit 8aa467f, Kernel Git Commit 8e19ded, Kernel Git Commit a466576, and Kernel Git Commit bdb732e. Rebuild kernels from a fixed stable release and reboot affected hosts.

Workarounds

Disable Hyper-V SynIC exposure to guests by removing hv-synic and hv-stimer from QEMU or libvirt CPU feature flags where the enlightenments are not required.
Avoid granting SCHED_FIFO scheduling policy to QEMU vCPU threads on unpatched hosts, which reduces the likelihood of RCU kthread starvation.
Limit guest privileges to prevent untrusted workloads from writing arbitrary Hyper-V MSR values until the kernel patch is deployed.

bash

# Configuration example: remove Hyper-V synthetic timer enlightenments in libvirt XML
# Edit the guest domain with: virsh edit <domain>
# Remove or disable the following elements under <features><hyperv>:
#   <synic state='on'/>
#   <stimer state='on'/>
# Then redefine and restart the guest:
virsh define /etc/libvirt/qemu/<domain>.xml
virsh destroy <domain> && virsh start <domain>