Linux Kernel: A Security Hole in Nested Virtualization
A late-arriving KVM fix closes a security gap that let a nested guest disable host x2APIC protections and destabilize the machine, while a smaller batch of tracing fixes tightens error handling in the kernel's probe infrastructure.
Duration: PT2M21S
Episode overview
This episode is a short developer briefing from Linux Kernel.
It explains recent repository work in plain language.
- Show: Linux Kernel
- Published: 2026-07-30T13:14:46Z
- Audio duration: PT2M21S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
This is Linux Kernel for July 30th, 2026.
The headline today is a security fix in KVM's AMD virtualization code, and it's worth understanding why it matters. Sean Christopherson's fix, folded into the broader KVM pull in commit fc46aed, addresses a bug where disabling AVIC, the advanced interrupt controller, while a nested guest was running left the host's…
That KVM pull carries a second theme: defensive hardening across architectures. On ARM64, there are fixes for LPI interrupt leaks and race conditions in the virtual interrupt controller, plus tightened memory allocation handling in the hypervisor tracing code. On S390, several fixes close resource leaks and missing…
A second, smaller theme comes from the tracing subsystem. Masami Hiramatsu's probes fixes, pulled in commit 11028ab, address three issues: a meta-argument expansion bug that could cause out-of-bounds reads, a missing rollback when fprobe registration fails partway through, and in commit 8cf2f40, a module reference…
What to remember: if you're working with nested virtualization on AMD hardware, this AVIC fix is one to pull in promptly. And across both KVM and tracing, the pattern is the same -- error and cleanup paths…
Th…
Nearby episodes from Linux Kernel
- Late-Cycle Fixes Converge on Btrfs Zoned Mode
- Late-Cycle Hotfix Sweep
- RC5 Fixes Sweep Across the Stack
- Weekly Recap - Late-Cycle Fixes Across the Stack
- Late-Cycle Fixes Roll In Ahead of 7.2
- A Release Candidate Full of Hardening Fixes
- Rc4 Cleanup Brings Memory Safety Fixes Across Networking and File Sharing
- Late-Cycle Fixes Converge on Rc5