CVE-2026-43483: KVM SVM Performance Bug in Linux Kernel
プラットフォーム
linux
コンポーネント
linux
修正版
ba3bca40f9f25c053f69413e5f4a41dd0fd762bf
CVE-2026-43483 addresses a performance-related issue within the Linux Kernel's Kernel-based Virtual Machine (KVM) module, specifically concerning the Second Level Address Translation (SLAT) feature (SVM). This vulnerability arises from a failure to properly clear CR8 write interception when Advanced Vector Extensions (AVIC) are deactivated. While not a direct security exploit on its own, the persistent interception can lead to significant performance degradation, especially when combined with other KVM bugs.
影響と攻撃シナリオ翻訳中…
The primary impact of CVE-2026-43483 is a performance degradation within virtual machines running on affected systems. The lingering CR8 write interception prevents efficient memory access, leading to slower VM execution and increased resource consumption. While this vulnerability doesn't directly allow for arbitrary code execution or data breaches, the performance impact can be substantial, particularly in environments with high VM density or resource-intensive workloads. The description explicitly mentions a connection to a separate bug (TPR sync) which, when combined, could exacerbate the performance issues. This could lead to denial-of-service conditions within the virtual machines themselves, effectively rendering them unusable.
悪用の状況翻訳中…
CVE-2026-43483 is not currently listed on KEV or EPSS. The CVSS score is pending evaluation. No public proof-of-concept exploits are currently known. The vulnerability was published on 2026-05-13, suggesting it was recently discovered and addressed. Given the performance-oriented nature of the vulnerability, active exploitation is considered unlikely, but ongoing monitoring is advised.
影響を受けるソフトウェア
タイムライン
- 予約済み
- 公開日
緩和策と回避策翻訳中…
The recommended mitigation for CVE-2026-43483 is to upgrade the Linux Kernel to version ba3bca40f9f25c053f69413e5f4a41dd0fd762bf or later. If a direct upgrade is not feasible due to compatibility constraints, consider rolling back to a previous stable kernel version that does not contain this vulnerability. There are no known WAF or proxy-based mitigations for this specific kernel vulnerability. Monitor VM performance closely; sustained performance degradation could indicate exploitation of this or related issues.
修正方法翻訳中…
Actualizar el kernel de Linux a la versión 6.6.1 o posterior para corregir la vulnerabilidad. Esta actualización aborda un problema donde la interceptación de escritura de CR8 no se restablecía correctamente después de la desactivación de AVIC, lo que podía provocar problemas de rendimiento y, en combinación con otros errores, ser fatal para los invitados de Windows.
よくある質問翻訳中…
What is CVE-2026-43483 — KVM SVM Performance Bug in Linux Kernel?
CVE-2026-43483 is a Linux Kernel vulnerability affecting the KVM SVM module. It causes a performance degradation due to a lingering CR8 write interception after AVIC deactivation, impacting virtual machine performance.
Am I affected by CVE-2026-43483 in Linux Kernel?
You are affected if your Linux Kernel version is less than or equal to ba3bca40f9f25c053f69413e5f4a41dd0fd762bf. Check your kernel version using 'uname -r'.
How do I fix CVE-2026-43483 in Linux Kernel?
Upgrade your Linux Kernel to version ba3bca40f9f25c053f69413e5f4a41dd0fd762bf or later. If upgrading is not possible, consider rolling back to a previous stable kernel.
Is CVE-2026-43483 being actively exploited?
Currently, there are no known public exploits or active campaigns targeting CVE-2026-43483. However, continuous monitoring is recommended.
Where can I find the official Linux advisory for CVE-2026-43483?
Refer to the Linux Kernel security announcements for details: https://lore.kernel.org/all/?q=CVE-2026-43483
今すぐ試す — アカウント不要
任意のマニフェスト（composer.lock、package-lock.json、WordPressプラグインリストなど）をアップロードするか、コンポーネントリストを貼り付けてください。脆弱性レポートを即座に入手できます。ファイルのアップロードはほんの始まりです。アカウントがあれば、継続的なモニタリング、Slack/メールアラート、マルチプロジェクト、ホワイトラベルレポートが使用できます。
依存関係ファイルをドラッグ＆ドロップ
composer.lock、package-lock.json、requirements.txt、Gemfile.lock、pubspec.lock、Dockerfile...