CVE-2026-72284

A flaw was found in the Kernel-based Virtual Machine (KVM) subsystem of the Linux kernel, specifically in the handling of Paravirtualized End Of Interrupt (PV EOI) for x86 virtual CPUs. A local attacker in a guest virtual machine could exploit a race condition where a virtual CPU disables PV EOIs after a request has been made. This can lead to an assertion failure, causing a kernel panic and resulting in a denial of service on the host system.

This vulnerability is rated as Moderate impact because triggering the issue requires local access within an x86 guest virtual machine to induce a race condition during interrupt servicing, restricting the blast radius to host denial of service without compromising data confidentiality or system integrity. In Red Hat Enterprise Linux environments, exposure is limited to hypervisors hosting untrusted x86 virtual machine workloads. Systems that do not provide virtualization services or run only fully trusted guests are not at risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.