PT-2026-37554 · Linux · Linux Kernel

Published 2026-05-06 · Updated 2026-05-15 · CVE-2026-43214

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the KVM x86 component where reading PDPTR registers in the get sregs2() function lacks proper SRCU read-side protection. Reading PDPTRs can trigger access to guest memory through a call chain involving kvm pdptr read(), svm cache reg(), load pdptrs(), kvm vcpu read guest page(), and kvm vcpu gfn to memslot(). The kvm vcpu gfn to memslot() function dereferences memslots via kvm memslots(), which requires either kvm->srcu or kvm->slots lock to be held. Because only vcpu->mutex is held during this operation, it triggers a lockdep warning due to suspicious RCU usage.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-43214

OESA-2026-2312

OESA-2026-2313

OESA-2026-2314

Affected Products

Linux Kernel

References · 41

• https://nvd.nist.gov/vuln/detail/CVE-2026-43214 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43019 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-43214 · Vendor Advisory
• https://git.kernel.org/stable/c/708e20c66b2761d878a2bc3c7534e7f814e4dec5 · Patch
• https://osv.dev/vulnerability/OESA-2026-2312 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43013 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31674 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31515 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43420 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31673 · Security Note
• https://git.kernel.org/stable/c/95d848dc7e639988dbb385a8cba9b484607cf98c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43284 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2314 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31575 · Security Note
• https://ubuntu.com/security/CVE-2026-43214 · Vendor Advisory