{
  "cveId": "CVE-2026-99178",
  "url": "https://patchblox.com/security/cve/CVE-2026-99178",
  "summary": "CVE-2026-99178 is fixed in linux on 1 platform by DEBIAN-CVE-2026-99178 (version 6.12.115-2), released November 3, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "x86/kvm: Don\u0027t consume async #PF flags on a kernel #PF in NMI context",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  x86/kvm: Don\u0027t consume async #PF flags on a kernel #PF in NMI context  An async #PF \u0022page not present\u0022 event arrives through the #PF vector, and its reason sits in the per-CPU apf_reason.flags until __kvm_handle_async_pf() reads and clears it. If an NMI arrives after the event is injected and before the #PF handler reads the flags, and the NMI handler itself takes a #PF, that fault reads and clears the flags belonging to the #PF it interrupted. It then finds interrupts disabled in the NMI context it interrupted, and panics:    Kernel panic - not syncing: Host injected async #PF in interrupt disabled region   Call Trace:    \u003CNMI\u003E    panic\u002B0x52/0x60    __kvm_handle_async_pf\u002B0xb0/0xb0    exc_page_fault\u002B0x71/0xb0    asm_exc_page_fault\u002B0x27/0x30   RIP: 0010:__get_user_nocheck_8\u002B0x6/0x20    perf_callchain_user\u002B0x147/0x1a0    get_perf_callchain\u002B0x12d/0x1c0    ...    perf_event_nmi_handler\u002B0x26/0x50    exc_nmi\u002B0xe8/0x110   RIP: 0010:asm_exc_page_fault\u002B0x0/0x30    \u003C/NMI\u003E  The last RIP line shows the NMI landing on the first instruction of the #PF entry. perf with user call chains takes such a fault: the sampling NMI walks the user stack with __get_user(), which faults when a saved frame pointer is not a valid user address or the walk runs off the top of the stack. The same window exists when KVM, running as an L1 hypervisor with DELIVERY_AS_PF_VMEXIT, reads the flags itself after a #PF VM-exit.  The NMI entry code saves and restores CR2 for this nesting, but not the async #PF reason. Andy Lutomirski described the race, with perf as the example, when async #PF delivery was reworked in 2020 [1]. Saving and clearing the flags across the NMI, next to CR2, was discussed there but not merged.  Since that rework, Linux has stopped setting KVM_ASYNC_PF_SEND_ALWAYS, so the host delivers \u0022page not present\u0022 only for user mode faults and a kernel-mode fault in NMI context (including kernel-mode #MC and #DB) cannot be an async page fault.  In that case, return without touching the flags so that the interrupted handler finds them intact.  Tested on v7.3-rc5 in a 4-vCPU, 2 GiB guest restored from a snapshot whose memory is served on demand through userfaultfd, so that reading it back takes async #PFs, while every thread samples hardware cycles with user call chains and points its frame pointer at an unmapped page. Without this patch the guest panicked as above in 3 of 3 runs. With it, the guest survived 3 of 3 runs of 60 seconds, and the host counted 148,441 to 153,334 kvm_async_pf_not_present events in the first 20 seconds of each. On 6.18.50 the results were the same: the guest panicked without the patch and survived with it.",
  "published": "2026-10-28T11:17:38Z",
  "severity": "Moderate",
  "cvss": 6.5,
  "epss": 0.00174,
  "epssPercentile": 0.06925,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-99178",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.115-2",
      "fix": "DEBIAN-CVE-2026-99178",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-99178",
      "released": "2026-11-03T18:58:21Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T18:46:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}