{"api_version":"1","generated_at":"2026-11-13T02:02:00+00:00","cve":"CVE-2026-99258","urls":{"html":"https://cve.report/CVE-2026-99258","api":"https://cve.report/api/cve/CVE-2026-99258.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-99258","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-99258"},"summary":{"title":"x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()\n\nhv_apicid_to_vp_index() currently uses the per-cpu hypercall input\nand output pages. This function is called when running in VTL2 and\nwhen running in an SEV-SNP CoCo VM with no paravisor. In the former\ncase, the output page is allocated, but in the latter case it is\nnot, so the hypervisor stores the output VP index in memory that has\nnot been allocated by the guest.\n\nFix this by using the input page for both input and output. The\nhypercall has very small input and output, so sharing the same\npage for both is straightforward. An alternative fix is to\nallocate the per-cpu output page when running in an SEV-SNP CoCo\nguest, but this uses significantly more memory, particularly\nwith larger vCPUs counts.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-11-03 12:17:32","updated_at":"2026-11-03 12:17:32"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/bdba5f1b8bd0d18b1df61f769b559ed272902489","name":"https://git.kernel.org/stable/c/bdba5f1b8bd0d18b1df61f769b559ed272902489","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2b561786c9076a892ef8b8f416c9828bc87ed44f","name":"https://git.kernel.org/stable/c/2b561786c9076a892ef8b8f416c9828bc87ed44f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7b74c117e2aac78e0f723e1c9c3644451c56b0d9","name":"https://git.kernel.org/stable/c/7b74c117e2aac78e0f723e1c9c3644451c56b0d9","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/bc8ca0f4769627ae7d04e7ffdbd20de4f27a9bf9","name":"https://git.kernel.org/stable/c/bc8ca0f4769627ae7d04e7ffdbd20de4f27a9bf9","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-99258","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99258","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3d12349ade541eefde0e71bf5c4aa7aa04c52a79 bdba5f1b8bd0d18b1df61f769b559ed272902489 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 86c48271e0d60c82665e9fd61277002391efcef7 2b561786c9076a892ef8b8f416c9828bc87ed44f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 86c48271e0d60c82665e9fd61277002391efcef7 bc8ca0f4769627ae7d04e7ffdbd20de4f27a9bf9 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 86c48271e0d60c82665e9fd61277002391efcef7 7b74c117e2aac78e0f723e1c9c3644451c56b0d9 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected cb002d6c8f06d6061e84b2109cb84416107a9fb9 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.12.41 6.12.115 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.15.3 6.16 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.16","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.16 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.115 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.59 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.13 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/hyperv/hv_init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"bdba5f1b8bd0d18b1df61f769b559ed272902489","status":"affected","version":"3d12349ade541eefde0e71bf5c4aa7aa04c52a79","versionType":"git"},{"lessThan":"2b561786c9076a892ef8b8f416c9828bc87ed44f","status":"affected","version":"86c48271e0d60c82665e9fd61277002391efcef7","versionType":"git"},{"lessThan":"bc8ca0f4769627ae7d04e7ffdbd20de4f27a9bf9","status":"affected","version":"86c48271e0d60c82665e9fd61277002391efcef7","versionType":"git"},{"lessThan":"7b74c117e2aac78e0f723e1c9c3644451c56b0d9","status":"affected","version":"86c48271e0d60c82665e9fd61277002391efcef7","versionType":"git"},{"status":"affected","version":"cb002d6c8f06d6061e84b2109cb84416107a9fb9","versionType":"git"},{"lessThan":"6.12.115","status":"affected","version":"6.12.41","versionType":"semver"},{"lessThan":"6.16","status":"affected","version":"6.15.3","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/hyperv/hv_init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.115","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.59","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.115","versionStartIncluding":"6.12.41","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.59","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.13","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()\n\nhv_apicid_to_vp_index() currently uses the per-cpu hypercall input\nand output pages. This function is called when running in VTL2 and\nwhen running in an SEV-SNP CoCo VM with no paravisor. In the former\ncase, the output page is allocated, but in the latter case it is\nnot, so the hypervisor stores the output VP index in memory that has\nnot been allocated by the guest.\n\nFix this by using the input page for both input and output. The\nhypercall has very small input and output, so sharing the same\npage for both is straightforward. An alternative fix is to\nallocate the per-cpu output page when running in an SEV-SNP CoCo\nguest, but this uses significantly more memory, particularly\nwith larger vCPUs counts."}],"providerMetadata":{"dateUpdated":"2026-11-03T11:40:46.409Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/bdba5f1b8bd0d18b1df61f769b559ed272902489"},{"url":"https://git.kernel.org/stable/c/2b561786c9076a892ef8b8f416c9828bc87ed44f"},{"url":"https://git.kernel.org/stable/c/bc8ca0f4769627ae7d04e7ffdbd20de4f27a9bf9"},{"url":"https://git.kernel.org/stable/c/7b74c117e2aac78e0f723e1c9c3644451c56b0d9"}],"title":"x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-99258","datePublished":"2026-11-03T11:25:14.680Z","dateReserved":"2026-09-25T10:25:14.404Z","dateUpdated":"2026-11-03T11:40:46.409Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-03 12:17:32","lastModifiedDate":"2026-11-03 12:17:32","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"99258","Ordinal":"1","Title":"x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_i","CVE":"CVE-2026-99258","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"99258","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()\n\nhv_apicid_to_vp_index() currently uses the per-cpu hypercall input\nand output pages. This function is called when running in VTL2 and\nwhen running in an SEV-SNP CoCo VM with no paravisor. In the former\ncase, the output page is allocated, but in the latter case it is\nnot, so the hypervisor stores the output VP index in memory that has\nnot been allocated by the guest.\n\nFix this by using the input page for both input and output. The\nhypercall has very small input and output, so sharing the same\npage for both is straightforward. An alternative fix is to\nallocate the per-cpu output page when running in an SEV-SNP CoCo\nguest, but this uses significantly more memory, particularly\nwith larger vCPUs counts.","Type":"Description","Title":"x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_i"}]}}}