CVE-2026-68093

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug<br /> <br /> If a vCPU stays scheduled out (or blocked) while the last pCPU it ran<br /> on goes through a hotplug cycle (online-&gt;offline-&gt;online), and the vCPU<br /> then resumes execution on the same pCPU, then it is possible for it to<br /> run with an ASID that has now been assigned to a different vCPU,<br /> resulting in stale TLB translations being used.<br /> <br /> svm_enable_virtualization_cpu() resets asid_generation to 1 and sets<br /> next_asid to max_asid + 1 on every CPU online event, including hotplug<br /> cycles. Because next_asid starts beyond the pool boundary, the first<br /> call to new_asid() after an online event always wraps the pool,<br /> incrementing asid_generation to 2 and assigning ASIDs starting from<br /> min_asid.<br /> <br /> Consider two vCPUs from different VMs, vCPU-A pinned to CPU-X holding<br /> asid_generation=2 and ASID=N from before the hotplug event:<br /> <br /> 1. CPU-X goes offline and back online: asid_generation resets to 1,<br /> next_asid = max_asid + 1.<br /> <br /> 2. One or more vCPUs migrate to CPU-X and call new_asid(), wrapping<br /> the pool and consuming ASIDs starting from min_asid. Eventually<br /> vCPU-B from a different VM is assigned asid_generation=2, ASID=N<br /> — the same ASID that vCPU-A held before the hotplug.<br /> <br /> 3. vCPU-A enters pre_svm_run() on CPU-X: current_vmcb-&gt;cpu is<br /> unchanged so the migration branch is skipped. Its saved<br /> asid_generation=2 matches sd-&gt;asid_generation=2, so the generation<br /> check silently passes and vCPU-A continues running with ASID=N —<br /> the same ASID just freshly assigned to vCPU-B.<br /> <br /> Both vCPUs from different VMs now run on CPU-X with the same ASID,<br /> causing them to share NPT TLB entries and producing stale translations.<br /> <br /> The collision manifests as a KVM internal error (Suberror: 1, emulation<br /> failure). The NPT page fault reports a faulting GPA far outside the<br /> VM&amp;#39;s physical memory range — a sign of stale TLB translations being<br /> used. KVM falls back to instruction emulation, which fails on<br /> FPU/XSave instructions (XRSTOR, STMXCSR) that the emulator does not<br /> implement.<br /> <br /> Fix this by incrementing asid_generation instead of resetting it to 1<br /> in svm_enable_virtualization_cpu(). On module load, asid_generation<br /> starts at 0 (memset) and the increment produces 1, identical to the<br /> old behaviour. On subsequent hotplug cycles the generation advances<br /> beyond any value a vCPU previously observed on this CPU, so the<br /> generation check in pre_svm_run() reliably forces new_asid() on every<br /> vCPU after every hotplug cycle.