CVE-2025-40026

A flaw was found in the Kernel-based Virtual Machine (KVM) for x86. This vulnerability occurs when KVM incorrectly re-checks Level 1 (L1) intercepts during the completion of userspace I/O emulation for a Level 2 (L2) instruction. If the L1 or host userspace modifies I/O interception settings during this process, KVM may misinterpret already-emulated I/O as intercepted. This can lead to a kernel warning and potentially disrupt the guest virtual machine, resulting in a denial of service. Exploitation requires local access to /dev/kvm and the ability to perform nested virtualization or manipulate I/O bitmaps.

KVM x86 was re-checking L1 instruction intercepts while completing a userspace I/O emulation for an L2 instruction. If L1 (or host userspace) modified I/O interception during the exit, KVM could wrongly treat the already-emulated I/O as intercepted and leave vcpu->arch.pio.count non-zero, triggering a WARN and potentially disrupting the guest. Practical exploitation requires local access to /dev/kvm and the ability to run nested virtualization or manipulate I/O bitmaps.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This vulnerability can be mitigated by disabling nested virtualization. Create a file in /etc/modprobe.d/ with a descriptive name, such as cve-2026-53359-mitigation.conf. In that file, disable nested virtualization for the kvm_intel and kvm_amd kernel modules:

options kvm-intel nested=0
options kvm-amd nested=0

Use lsmod to determine if either module is already loaded. If so, remove loaded modules with modprobe -r. To validate that nested virtualization is disabled, read the files /sys/module/kvm_intel/parameters/nested and /sys/module/kvm_amd/parameters/nested. If these modules are loaded, those files should read N to indicate that the feature is disabled.

In OpenShift 4, a MachineConfig can be utilized to create a modprobe configuration allowing control of the module on applicable nodes. See the following article for an example.

https://access.redhat.com/solutions/6979679