Vulnerability · CVE-2026-99178

x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context

Published Oct 28, 2026 · catalog updated Nov 2, 2026 · Red Hat Red Hat Enterprise Linux

Last checked Nov 3, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-99178. EPSS is 0.17%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Gaps on this record

No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity: Medium4.7
Known exploitation: Not in CISA/VulnCheck KEV
EPSS: 0.17%
Remediation: Advisory link
Affected products: Linux Kernel · Ubuntu:16.04:LTS linux-hwe-edge · Ubuntu:Pro:14.04:LTS linux · Ubuntu:Pro:14.04:LTS linux-aws · Ubuntu:Pro:14.04:LTS linux-azure · Ubuntu:Pro:14.04:LTS linux-lts-xenial

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context An async #PF "page not present" event arrives through the #PF vector, and its reason sits in the per-CPU apf_reason.flags until __kvm_handle_async_pf() reads and clears it. If an NMI arrives after the event is injected and before the #PF handler reads the flags, and the NMI handler itself takes a #PF, that fault reads and clears the flags belonging to the #PF it interrupted. It then finds interrupts disabled in the NMI context it interrupted, and panics: Kernel panic - not syncing: Host injected async #PF in interrupt disabled region Call Trace: panic+0x52/0x60 __kvm_handle_async_pf+0xb0/0xb0 exc_page_fault+0x71/0xb0 asm_exc_page_fault+0x27/0x30 RIP: 0010:__get_user_nocheck_8+0x6/0x20 perf_callchain_user+0x147/0x1a0 get_perf_callchain+0x12d/0x1c0 ... perf_event_nmi_handler+0x26/0x50 exc_nmi+0xe8/0x110 RIP: 0010:asm_exc_page_fault+0x0/0x30 The last RIP line shows the NMI landing on the first instruction of the #PF entry. perf with user call chains takes such a fault: the sampling NMI walks the user stack with __get_user(), which faults when a saved frame pointer is not a valid user address or the walk runs off the top of the stack. The same window exists when KVM, running as an L1 hypervisor with DELIVERY_AS_PF_VMEXIT, reads the flags itself after a #PF VM-exit. The NMI entry code saves and restores CR2 for this nesting, but not the async #PF reason. Andy Lutomirski described the race, with perf as the example, when async #PF delivery was reworked in 2020 [1]. Saving and clearing the flags across the NMI, next to CR2, was discussed there but not merged. Since that rework, Linux has stopped setting KVM_ASYNC_PF_SEND_ALWAYS, so the host delivers "page not present" only for user mode faults and a kernel-mode fault in NMI context (including kernel-mode #MC and #DB) cannot be an async page fault. In that case, return without touching th

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

Linux Kernel2.6.38 → 6.12.115; 6.13.0 → 6.18.59; 6.19.0 → 7.2.13
Ubuntu:16.04:LTS linux-hwe-edge4.8.0-28.30~16.04.1, 4.8.0-30.32~16.04.1, 4.8.0-32.34~16.04.1
Ubuntu:Pro:14.04:LTS linux3.11.0-12.19, 3.12.0-1.3, 3.12.0-2.5
Ubuntu:Pro:14.04:LTS linux-aws4.4.0-1002.2, 4.4.0-1003.3, 4.4.0-1005.5
Ubuntu:Pro:14.04:LTS linux-azure4.15.0-1023.24~14.04.1, 4.15.0-1030.31~14.04.1, 4.15.0-1031.32~14.04.1
Ubuntu:Pro:14.04:LTS linux-lts-xenial4.4.0-13.29~14.04.1, 4.4.0-14.30~14.04.2, 4.4.0-15.31~14.04.1
Ubuntu:Pro:16.04:LTS linux4.2.0-16.19, 4.2.0-17.21, 4.2.0-19.23
Ubuntu:Pro:16.04:LTS linux-aws4.4.0-1001.10, 4.4.0-1003.12, 4.4.0-1004.13
Ubuntu:Pro:16.04:LTS linux-aws-hwe4.15.0-1030.31~16.04.1, 4.15.0-1031.33~16.04.1, 4.15.0-1032.34~16.04.1
Ubuntu:Pro:16.04:LTS linux-azure4.11.0-1009.9, 4.11.0-1011.11, 4.11.0-1013.13
Ubuntu:Pro:16.04:LTS linux-gcp4.10.0-1004.4, 4.10.0-1006.6, 4.10.0-1007.7
Ubuntu:Pro:16.04:LTS linux-hwe4.8.0-36.36~16.04.1, 4.8.0-39.42~16.04.1, 4.8.0-41.44~16.04.1
Ubuntu:Pro:16.04:LTS linux-kvm4.4.0-1004.9, 4.4.0-1007.12, 4.4.0-1008.13
vendor Linux Linuxversion unspecified

How to fix CVE-2026-99178

Upgrade
CVE-2026-99178 lists a fix boundary at 6.12.115. Compare the installed build with that boundary before you change production.
Version check
Seen in 2.6.38 → 6.12.115; 6.13.0 → 6.18.59; 6.19.0 → 7.2.13 · 15 other packages on the advisory
Advisory
Open the bsi record and follow its fix.
Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-99178. EPSS is 0.17%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Which versions are affected?

Compare what you have installed with Kernel 2.6.38 → 6.12.115; 6.13.0 → 6.18.59; 6.19.0 → 7.2.13. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-364. EPSS 0.17%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Ubuntu security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

Oct 28, 2026 · Tenable CVE Database
Detected
In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context An async #PF "page not present" event arrives through the #PF vector, and its reason sits in the per-CPU apf_reason.flags until __kvm_handle_async_pf() reads and clears it. If an NMI arrives after the event is injected and before the #PF handler reads the flags,
Oct 28, 2026 · CVE.org
Updated
In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context An async #PF "page not present" event arrives through the #PF vector, and its reason sits in the per-CPU apf_reason.flags until __kvm_handle_async_pf() reads and clears it. If an NMI arrives after the event is injected and before the #PF handler reads the flags,
Oct 29, 2026 · OpenSSF OSV / OSV Scanner
Updated
In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context An async #PF "page not present" event arrives through the #PF vector, and its reason sits in the per-CPU apf_reason.flags until __kvm_handle_async_pf() reads and clears it. If an NMI arrives after the event is injected and before the #PF handler reads the flags,
Oct 30, 2026 · OpenSSF OSV / OSV Scanner
Updated
In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context An async #PF "page not present" event arrives through the #PF vector, and its reason sits in the per-CPU apf_reason.flags until __kvm_handle_async_pf() reads and clears it. If an NMI arrives after the event is injected and before the #PF handler reads the flags,
Nov 1, 2026 · NIST NVD
Updated
In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context An async #PF "page not present" event arrives through the #PF vector, and its reason sits in the per-CPU apf_reason.flags until __kvm_handle_async_pf() reads and clears it. If an NMI arrives after the event is injected and before the #PF handler reads the flags,
Nov 2, 2026 · OpenSSF OSV / OSV Scanner
Fix available
Kernel fixed in 6.12.115; Kernel fixed in 6.18.59; Kernel fixed in 7.2.13
Nov 2, 2026 · OpenSSF OSV / OSV Scanner
Fix available
Kernel fixed in 6.12.115; 6.13.0
Nov 2, 2026 · OpenSSF OSV / OSV Scanner
Updated
In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context An async #PF "page not present" event arrives through the #PF vector, and its reason sits in the per-CPU apf_reason.flags until __kvm_handle_async_pf() reads and clears it. If an NMI arrives after the event is injected and before the #PF handler reads the flags,

Sources

BSI CERT-BundGovernment advisoryCVE-2026-99178
Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff
wid.cert-bund.de
CVE.orgVulnerability recordCVE-2026-99178
In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context An async #PF "page not present" event arrives through the #PF vector, and its reason sits in the per-CPU apf_reason.flags until __kvm_handle_a
cve.org
FIRST EPSSExploitation probabilityCVE-2026-99178
30-day exploitation probability 0.17%
first.org
NIST NVDVulnerability recordCVE-2026-99178
In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context An async #PF "page not present" event arrives through the #PF vector, and its reason sits in the per-CPU apf_reason.flags until __kvm_handle
nvd.nist.gov
OpenSSF OSV / OSV ScannerPackage advisoryCVE-2026-99178
x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context
osv.dev
OpenSSF OSV / OSV ScannerPackage advisoryUBUNTU-CVE-2026-99178
osv.dev
Red Hat Security DataVendor advisoryCVE-2026-99178
kernel: kernel: Denial of Service via race condition in KVM asynchronous page fault handling
access.redhat.com
Tenable CVE DatabaseVulnerability recordCVE-2026-99178
In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context An async #PF "page not present" event arrives through the #PF vector, and its reason sits in the per-CPU apf_reason.flags until __kvm_handle_async_pf() reads and clears it. If an NMI arrives after the event is injected and before the #PF handler reads the flags,
tenable.com

References

Freshness

Last verified in this catalog Nov 3, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

OpenSSF OSV / OSV ScannerNov 2, 2026
NIST NVDNov 1, 2026
FIRST EPSSOct 31, 2026
Red Hat Security DataOct 30, 2026
BSI CERT-BundOct 30, 2026
OpenSSF OSV / OSV ScannerOct 30, 2026
CVE.orgOct 29, 2026
Tenable CVE DatabaseOct 28, 2026

Priority score

19/100

Evidence confidence: High

A vendor or government advisory agrees with at least one other source.

Confirmed exploitation0/30
EPSS probability1/20
CVSS severity7/15
Public exploit0/10
Internet exposure6/10
Product prevalence5/5
Detection0/5
Threat research0/5

Decision signals

Four separate signals — do not infer one from another.

Medium

CVSS severity
4.7 v3.1
Technical impact. Separate from exploitation likelihood.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS probability
0.17% · p6.87%
Estimated probability of exploitation within 30 days (FIRST).
Known exploitation
No verified KEV listing
Evidence from CISA KEV or VulnCheck KEV only — not from EPSS alone.
Patch availability
Advisory link
A patch or advisory reference is linked. Open the original publisher for availability by product version.

Stacks

Linux Red Hat Ubuntu Ubuntu 14.04 Ubuntu 16.04

Weakness

CWE-364 MITRE definition

Watch

A free account watches 5 technologies and gets a weekly digest. Professional adds immediate alerts.