Unrated severityNVD Advisory· Published Jun 8, 2026

CVE-2026-46295

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty

Fall back to apic_find_highest_vector() when PID.ON is set but PIR turns out to be empty, to correctly report the highest pending interrupt from the existing IRR.

In a nested VM stress test, the following WARNING fires in vmx_check_nested_events() when kvm_cpu_has_interrupt() reports a pending interrupt but the subsequent kvm_apic_has_interrupt() (which invokes vmx_sync_pir_to_irr() again) returns -1:

WARNING: CPU: 99 PID: 57767 at arch/x86/kvm/vmx/nested.c:4449 vmx_check_nested_events+0x6bf/0x6e0 [kvm_intel] Call Trace: kvm_check_and_inject_events vcpu_enter_guest.constprop.0 vcpu_run kvm_arch_vcpu_ioctl_run kvm_vcpu_ioctl __x64_sys_ioctl do_syscall_64 entry_SYSCALL_64_after_hwframe

The root cause is a race between vmx_sync_pir_to_irr() on the target vCPU and __vmx_deliver_posted_interrupt() on a sender vCPU. The sender performs two individually-atomic operations that are not a single transaction:

pi_test_and_set_pir(vector) -- sets the PIR bit
pi_test_and_set_on() -- sets PID.ON

The following interleaving triggers the bug:

Sender vCPU (IPI): Target vCPU (1st sync_pir_to_irr): B1: set PIR[vector] A1: pi_clear_on() A2: pi_harvest_pir() -> sees B1 bit A3: xchg() -> consumes bit, PIR=0 (1st sync returns correct max_irr) B2: set PID.ON = 1

Target vCPU (2nd sync_pir_to_irr): C1: pi_test_on() -> TRUE (from B2) C2: pi_clear_on() -> ON=0 C3: pi_harvest_pir() -> PIR empty C4: *max_irr = -1, early return IRR NOT SCANNED

The interrupt is not lost (it resides in the IRR from the first sync and is recovered on the next vcpu_enter_guest() iteration), but the incorrect max_irr causes a spurious WARNING and a wasted L2 VM-Enter/VM-Exit cycle.

Affected products

Google/Android SDKinferred
Linux/kvm_intelllm-create
Linux/Kernelllm-fuzzy

Patches

4b6b06a8b12b

KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitPaolo BonziniFixed in 7.0.7via kernel-cna

commit

1 file changed · +5 −4

arch/x86/kvm/lapic.c+5 −4 modified

diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 9381c58d4c85c..e9f1e54511601 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -669,12 +669,14 @@ bool __kvm_apic_update_irr(unsigned long *pir, void *regs, int *max_irr)
 	u32 irr_val, prev_irr_val;
 	int max_updated_irr;
 
+	if (!pi_harvest_pir(pir, pir_vals)) {
+		*max_irr = apic_find_highest_vector(regs + APIC_IRR);
+		return false;
+	}
+
 	max_updated_irr = -1;
 	*max_irr = -1;
 
-	if (!pi_harvest_pir(pir, pir_vals))
-		return false;
-
 	for (i = vec = 0; i <= 7; i++, vec += 32) {
 		u32 *p_irr = (u32 *)(regs + APIC_IRR + i * 0x10);
 
-- 
cgit 1.3-korg

bb1703949dca

KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitPaolo BonziniFixed in 6.18.30via kernel-cna

commit

1 file changed · +5 −4

arch/x86/kvm/lapic.c+5 −4 modified

diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index a9845a1a9cd5d..0e842dad4194a 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -669,12 +669,14 @@ bool __kvm_apic_update_irr(unsigned long *pir, void *regs, int *max_irr)
 	u32 irr_val, prev_irr_val;
 	int max_updated_irr;
 
+	if (!pi_harvest_pir(pir, pir_vals)) {
+		*max_irr = apic_find_highest_vector(regs + APIC_IRR);
+		return false;
+	}
+
 	max_updated_irr = -1;
 	*max_irr = -1;
 
-	if (!pi_harvest_pir(pir, pir_vals))
-		return false;
-
 	for (i = vec = 0; i <= 7; i++, vec += 32) {
 		u32 *p_irr = (u32 *)(regs + APIC_IRR + i * 0x10);
 
-- 
cgit 1.3-korg

33fd0ccd2590

KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitPaolo BonziniFixed in 7.1-rc3via kernel-cna

commit

1 file changed · +5 −4

arch/x86/kvm/lapic.c+5 −4 modified

diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index e3ec4d8607c19..5ee14d6bc2883 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -669,12 +669,14 @@ bool __kvm_apic_update_irr(unsigned long *pir, void *regs, int *max_irr)
 	u32 irr_val, prev_irr_val;
 	int max_updated_irr;
 
+	if (!pi_harvest_pir(pir, pir_vals)) {
+		*max_irr = apic_find_highest_vector(regs + APIC_IRR);
+		return false;
+	}
+
 	max_updated_irr = -1;
 	*max_irr = -1;
 
-	if (!pi_harvest_pir(pir, pir_vals))
-		return false;
-
 	for (i = vec = 0; i <= 7; i++, vec += 32) {
 		u32 *p_irr = (u32 *)(regs + APIC_IRR + i * 0x10);
 
-- 
cgit 1.3-korg

4b6b06a8b12b

KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitPaolo Bonzinivia nvd-ref

commit

1 file changed · +5 −4

arch/x86/kvm/lapic.c+5 −4 modified

diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 9381c58d4c85c..e9f1e54511601 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -669,12 +669,14 @@ bool __kvm_apic_update_irr(unsigned long *pir, void *regs, int *max_irr)
 	u32 irr_val, prev_irr_val;
 	int max_updated_irr;
 
+	if (!pi_harvest_pir(pir, pir_vals)) {
+		*max_irr = apic_find_highest_vector(regs + APIC_IRR);
+		return false;
+	}
+
 	max_updated_irr = -1;
 	*max_irr = -1;
 
-	if (!pi_harvest_pir(pir, pir_vals))
-		return false;
-
 	for (i = vec = 0; i <= 7; i++, vec += 32) {
 		u32 *p_irr = (u32 *)(regs + APIC_IRR + i * 0x10);
 
-- 
cgit 1.3-korg

bb1703949dca

KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitPaolo Bonzinivia nvd-ref

commit

1 file changed · +5 −4

arch/x86/kvm/lapic.c+5 −4 modified

diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index a9845a1a9cd5d..0e842dad4194a 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -669,12 +669,14 @@ bool __kvm_apic_update_irr(unsigned long *pir, void *regs, int *max_irr)
 	u32 irr_val, prev_irr_val;
 	int max_updated_irr;
 
+	if (!pi_harvest_pir(pir, pir_vals)) {
+		*max_irr = apic_find_highest_vector(regs + APIC_IRR);
+		return false;
+	}
+
 	max_updated_irr = -1;
 	*max_irr = -1;
 
-	if (!pi_harvest_pir(pir, pir_vals))
-		return false;
-
 	for (i = vec = 0; i <= 7; i++, vec += 32) {
 		u32 *p_irr = (u32 *)(regs + APIC_IRR + i * 0x10);
 
-- 
cgit 1.3-korg

33fd0ccd2590

KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitPaolo Bonzinivia nvd-ref

commit

1 file changed · +5 −4

arch/x86/kvm/lapic.c+5 −4 modified

diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index e3ec4d8607c19..5ee14d6bc2883 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -669,12 +669,14 @@ bool __kvm_apic_update_irr(unsigned long *pir, void *regs, int *max_irr)
 	u32 irr_val, prev_irr_val;
 	int max_updated_irr;
 
+	if (!pi_harvest_pir(pir, pir_vals)) {
+		*max_irr = apic_find_highest_vector(regs + APIC_IRR);
+		return false;
+	}
+
 	max_updated_irr = -1;
 	*max_irr = -1;
 
-	if (!pi_harvest_pir(pir, pir_vals))
-		return false;
-
 	for (i = vec = 0; i <= 7; i++, vec += 32) {
 		u32 *p_irr = (u32 *)(regs + APIC_IRR + i * 0x10);
 
-- 
cgit 1.3-korg

Vulnerability mechanics

Root cause

"A race condition exists between interrupt handling on the target vCPU and interrupt delivery on the sender vCPU."

Attack vector

This vulnerability is triggered during a nested VM stress test. A sender vCPU sends an IPI, which involves setting the PIR bit and then the PID.ON bit. An interleaving occurs where the target vCPU clears PID.ON and harvests PIR, then consumes the PIR bit, before the sender vCPU sets PID.ON. Subsequently, the target vCPU's second PIR harvest finds PIR empty but PID.ON set, leading to an incorrect max_irr value.

Affected code

The vulnerability lies within the `__kvm_apic_update_irr` function in `arch/x86/kvm/lapic.c`. The race condition occurs due to the interaction between `vmx_sync_pir_to_irr` on the target vCPU and `__vmx_deliver_posted_interrupt` on a sender vCPU.

What the fix does

The patch modifies the `__kvm_apic_update_irr` function. Previously, if `pi_harvest_pir` returned false (indicating an empty PIR), the function would return early. The fix ensures that even if PIR is empty, if PID.ON is set, the function will now call `apic_find_highest_vector` to correctly determine the highest pending interrupt from the existing IRR. This prevents the incorrect -1 return value that caused the warning.

Preconditions

configA nested virtual machine environment must be configured.
inputA stress test scenario involving IPIs between vCPUs is required to trigger the race condition.

Generated on Jun 8, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

News mentions

Google Android SDK: 10 Linux Kernel Vulnerabilities Disclosed Together
Vypr Intelligence · Jun 8, 2026
Linux Kernel: 25 Vulnerabilities Disclosed in Single Batch on June 8, 2026
Vypr Intelligence · Jun 8, 2026

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000