CVE-2026-89927

A flaw was found in the KVM (Kernel-based Virtual Machine) component of the Linux kernel. A local attacker, or a malicious guest operating system, could exploit an integer overflow vulnerability by programming a Hyper-V synthetic timer with a deadline in the past. This can prevent the CPU from making progress, leading to a system livelock and a denial of service (DoS).

A KVM x86 Hyper-V synthetic timer can be programmed with a very large COUNT value so that conversion from 100ns ticks to an absolute hrtimer deadline overflows. This may arm the timer in the past, make it fire immediately, raise KVM_REQ_HV_STIMER again, and keep vcpu_enter_guest from making forward progress. The observable impact is CPU livelock, RCU stall, and denial of service on the host. For the CVSS the PR:L is selected because a local process with KVM access or privileged code inside a guest can program the Hyper-V synthetic timer, but no host administrator privileges are normally required in common KVM deployments. The issue is not network reachable and there is no evidence of a memory corruption primitive, information disclosure, or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.