CVE-2026-72284

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the KVM x86 component where the system fails to ignore internal service pending PV EOI requests if the vCPU has disabled PV EOIs after the request was initiated. This can lead to a kernel BUG when asserting that PV EOIs are enabled, specifically if reading guest memory in the pv eoi get user() function fails, causing pv eoi test and clr pending() to bail early while the vCPU simultaneously disables PV EOIs. The issue manifests in the kvm lapic sync from vapic() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.