CVE-2026-23425 | Linux Kernel up to 6.18.16/6.19.6/7.0-rc1 KVM pkvm_init_features_from_host initialization

VDB-355098 · CVE-2026-23425 · GCVE-0-2026-23425 LINUX KERNEL UP TO 6.18.16/6.19.6/7.0-RC1 KVM PKVM_INIT_FEATURES_FROM_HOST INITIALIZATION HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 5.3 $0-$5k 0.82+ Summaryinfo A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.18.16/6.19.6/7.0-rc1. The impacted element is the function pkvm_init_features_from_host of the component KVM. The manipulation results in initialization. This vulnerability was named CVE-2026-23425. There is no available exploit. You should upgrade the affected component. Detailsinfo A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.18.16/6.19.6/7.0-rc1. Affected is the function pkvm_init_features_from_host of the component KVM. The manipulation with an unknown input leads to a initialization vulnerability. CWE is classifying the issue as CWE-665. The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used. The impact remains unknown. CVE summarizes: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix ID register initialization for non-protected pKVM guests In protected mode, the hypervisor maintains a separate instance of the `kvm` structure for each VM. For non-protected VMs, this structure is initialized from the host's `kvm` state. Currently, `pkvm_init_features_from_host()` copies the `KVM_ARCH_FLAG_ID_REGS_INITIALIZED` flag from the host without the underlying `id_regs` data being initialized. This results in the hypervisor seeing the flag as set while the ID registers remain zeroed. Consequently, `kvm_has_feat()` checks at EL2 fail (return 0) for non-protected VMs. This breaks logic that relies on feature detection, such as `ctxt_has_tcrx()` for TCR2_EL1 support. As a result, certain system registers (e.g., TCR2_EL1, PIR_EL1, POR_EL1) are not saved/restored during the world switch, which could lead to state corruption. Fix this by explicitly copying the ID registers from the host `kvm` to the hypervisor `kvm` for non-protected VMs during initialization, since we trust the host with its non-protected guests' features. Also ensure `KVM_ARCH_FLAG_ID_REGS_INITIALIZED` is cleared initially in `pkvm_init_features_from_host` so that `vm_copy_id_regs` can properly initialize them and set the flag once done. The advisory is available at git.kernel.org. This vulnerability is traded as CVE-2026-23425 since 01/13/2026. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 04/03/2026). Upgrading to version 6.18.17, 6.19.7 or 7.0-rc2 eliminates this vulnerability. Applying the patch bce3847f7c51b86332bf2e554c9e80ca3820f16c/858620655c1fbff05997e162fc7d83a3293d5142/7e7c2cf0024d89443a7af52e09e47b1fe634ab17 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version. Productinfo Type Operating System Vendor Linux Name Kernel Version 6.18.0 6.18.1 6.18.2 6.18.3 6.18.4 6.18.5 6.18.6 6.18.7 6.18.8 6.18.9 6.18.10 6.18.11 6.18.12 6.18.13 6.18.14 6.18.15 6.18.16 6.19.0 6.19.1 6.19.2 6.19.3 6.19.4 6.19.5 6.19.6 7.0-rc1 License open-source Website Vendor: https://www.kernel.org/ CPE 2.3info 🔒 🔒 🔒 CPE 2.2info 🔒 🔒 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv3info VulDB Meta Base Score: 5.5 VulDB Meta Temp Score: 5.3 VulDB Base Score: 5.5 VulDB Temp Score: 5.3 VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: Initialization CWE: CWE-665 CAPEC: 🔒 ATT&CK: 🔒 Physical: No Local: No Remote: Partially Availability: 🔒 Status: Not defined Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Upgrade Status: 🔍 0-Day Time: 🔒 Upgrade: Kernel 6.18.17/6.19.7/7.0-rc2 Patch: bce3847f7c51b86332bf2e554c9e80ca3820f16c/858620655c1fbff05997e162fc7d83a3293d5142/7e7c2cf0024d89443a7af52e09e47b1fe634ab17 Timelineinfo 01/13/2026 CVE reserved 04/03/2026 +79 days Advisory disclosed 04/03/2026 +0 days VulDB entry created 04/03/2026 +0 days VulDB entry last update Sourcesinfo Vendor: kernel.org Advisory: git.kernel.org Status: Confirmed CVE: CVE-2026-23425 (🔒) GCVE (CVE): GCVE-0-2026-23425 GCVE (VulDB): GCVE-100-355098 Entryinfo Created: 04/03/2026 17:03 Changes: 04/03/2026 17:03 (59) Complete: 🔍 Cache ID: 99:BBB:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸