Live › vulnerability › CVE-2026-99258
In Hyper-V guests running the Linux kernel, the APIC-ID-to-VP-index lookup used a per-CPU output page that was not allocated on SEV-SNP confidential VMs without a paravisor, so the hypervisor wrote the result into guest memory the guest never allocated. The sources do not state what an attacker can do with this write.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 12:20 UTC. All times on this page are UTC.
The flaw is in the Linux kernel's Hyper-V code path that runs in VTL2 and in SEV-SNP confidential VMs without a paravisor, where the output page is missing. Teams running Linux guests on Hyper-V with confidential computing should look at it; ordinary Linux guests on Hyper-V or other hypervisors are outside the described path. The sources do not describe the exploit conditions further.
No product ranges from the sources yet.
uname -r and compare it against the fixed kernel releases in the NVD entry.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()
hv_apicid_to_vp_index() currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP CoCo VM with no paravisor. In the former case, the output page is allocated, but in the latter case it is not, so the hypervisor stores the output VP index in memory that has not been allocated by the guest.
Fix this by using the input page for both input and output. The hypercall has very small input and output, so sharing the same page for both is straightforward. An alternative fix is to allocate the per-cpu output page when running in an SEV-SNP CoCo guest, but this uses significantly more memory, particularly with larger vCPUs counts.
This page as .md · .json · in your agent: get_signal("CVE-2026-99258")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.