{
"schemaVersion": 1,
"attribution": [
{
"source": "CISA Known Exploited Vulnerabilities",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"licence": "US government work"
},
{
"source": "GitHub Advisory Database",
"url": "https://github.com/advisories",
"licence": "CC BY 4.0"
},
{
"source": "Have I Been Pwned",
"url": "https://haveibeenpwned.com/",
"licence": "CC BY 4.0"
},
{
"source": "CVE Program (CVE records)",
"url": "https://www.cve.org/Legal/TermsOfUse",
"licence": "CVE Terms of Use",
"notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
"terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
},
{
"source": "FIRST EPSS",
"url": "https://www.first.org/epss/",
"licence": "free to use; FIRST requests attribution"
}
],
"record": {
"id": "CVE-2026-89927",
"sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-89927",
"idYear": 2026,
"status": "PUBLISHED",
"publishedAt": "2026-09-16T10:32:19.473Z",
"updatedAt": "2026-10-19T08:55:02.078Z",
"importedAt": "2026-10-24T01:58:35.090Z",
"snapshot": {
"id": "cve_2026-10-24_midnight_baseline",
"at": "2026-10-24T00:00:00.000Z",
"source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
},
"facts": {
"title": "KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock",
"summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: hyper-v: Clamp stimer deadline to avoid livelock\n\nFix an issue where userspace or the guest can program an Hyper-V\nsynthetic timer to have a deadline in the past via integer overflow,\npreventing the CPU from making progress and triggering an RCU stall.\n\nHyper-V's SynIC exposes 4 per-vCPU synthetic timers to the\nguest, which are emulated by KVM. Each is programmed through the\nHV_X64_MSR_STIMERi_CONFIG and HV_X64_MSR_STIMERi_COUNT MSRs. Depending\non CONFIG, COUNT represents either the absolute expiration time or the\nperiod of a periodic timer, both expressed in 100ns ticks. These timers\nmay be set both by the guest (WRMSR) and the host (KVM_SET_MSRS).\n\nWhen the timer is enabled, stimer_start() translates COUNT to an\nabsolute monotonic deadline and arms an hrtimer. If COUNT is set to a\nvalue close to U64_MAX, the deadline calculation can overflow.\n\n ktime_add_ns(ktime_now, 100 * (stimer->exp_time - time_now))\n\nThis can result in a CPU livelock. stimer_start() arms the timer\nvia hrtimer_start() with a deadline in the past, which causes it to\nimmediately fire. The stimer callback then raises KVM_RQ_HV_STIMER, with\nthe intention of causing KVM to deliver a synthetic interrupt on the\nnext vCPU guest enter.\n\nThen, once userspace issues KVM_RUN, vcpu_enter_guest() consumes the\nrequest, calling kvm_hv_process_stimers(). This would normally disable\nthe timer via stimer_expiration() once the deadline is in the past.\nHowever, the deadline comparison is done between the KVM reference\ncounter and stime->exp_time, which is a big value close to U64_MAX, so\nthis never happens for a few thousand years.\n\nkvm_hv_process_timers() then re-arms the timer via stimer_start(), since\nit was not disabled, which again fires immediately. Before entering\nthe guest, kvm_vcpu_exit_request() checks kvm_request_pending(),\nwhich returns true due to the newly raised KVM_REQ_HV_STIMER. Then\nvcpu_enter_guest() aborts the guest entry, returning early into\nvcpu_run(), which loops back again into vcpu_enter_guest(), restarting\nthe cycle.\n\nSince there are no manual yields in this loop, a task with SCHED_FIFO\nmay starve RCU grace-period kthreads, which exposes the stalls found\nby syzcaller:\n\n rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:\n rcu: (detected by 1, t=10502 jiffies, g=14269, q=1142 ncpus=2)\n rcu: All QSes seen, last rcu_preempt kthread activity 10500 (4294965239-4294954739), jiffies_till_next_fqs=1, root ->qsmask 0x0\n rcu: rcu_preempt kthread starved for 10500 jiffies! g14269 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0\n rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.\n ( ... )\n Call Trace:\n \n __run_hrtimer kernel/time/hrtimer.c:1773 [inline]\n __hrtimer_run_queues+0x408/0xc30 kernel/time/hrtimer.c:1841\n hrtimer_interrupt+0x45b/0xaa0 kernel/time/hrtimer.c:1903\n local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1045 [inline]\n __sysvec_apic_timer_interrupt+0x102/0x3e0 arch/x86/kernel/apic/apic.c:1062\n instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]\n sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1056\n \n \n asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697\n RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]\n RIP: 0010:_raw_spin_unlock_irqrestore+0xa8/0x110 kernel/locking/spinlock.c:194\n Code: 74 05 e8 0b f4 5f f6 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f6 44 24 21 02 75 4f f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 23 6b 27 f6 65 8b 05 7c 60 5a 07 85 c0 74 40 48 c7 04 24 0e 36\n RSP: 0018:ffffc900040a7320 EFLAGS: 00000206\n RAX: 5de15cb931505900 RBX: 0000000000000a06 RCX: 5de15cb931505900\n RDX: 0000000000000007 RSI: ffffffff8daa9dc3 RDI: 0000000000000001\n RBP: ffffc900040a73b0 R08: ffffffff8fc3d0\n---truncated---",
"affected": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1f4b34f825e8cef6f493d06b46605384785b3d16",
"status": "affected",
"versionType": "git",
"lessThan": "a4665762388750e08df99baabe5fce2a21d1423e"
},
{
"version": "1f4b34f825e8cef6f493d06b46605384785b3d16",
"status": "affected",
"versionType": "git",
"lessThan": "61954727ee08f026f5e1c9ee69e1b404a68f2f7a"
},
{
"version": "1f4b34f825e8cef6f493d06b46605384785b3d16",
"status": "affected",
"versionType": "git",
"lessThan": "8aa467fe757d8cb2278e98d7fbf44fc05eb0dbf8"
},
{
"version": "1f4b34f825e8cef6f493d06b46605384785b3d16",
"status": "affected",
"versionType": "git",
"lessThan": "8e19ded84336891646b31375720717635f0fdd90"
},
{
"version": "1f4b34f825e8cef6f493d06b46605384785b3d16",
"status": "affected",
"versionType": "git",
"lessThan": "6a8ba9213cce613455b1502ee0fd178656bf617b"
},
{
"version": "1f4b34f825e8cef6f493d06b46605384785b3d16",
"status": "affected",
"versionType": "git",
"lessThan": "3097582b73a8ed1cd6f6790fa78706f4a79b5a49"
},
{
"version": "1f4b34f825e8cef6f493d06b46605384785b3d16",
"status": "affected",
"versionType": "git",
"lessThan": "bdb732ebee545b7e3bee7060efc754a8d99818b9"
},
{
"version": "1f4b34f825e8cef6f493d06b46605384785b3d16",
"status": "affected",
"versionType": "git",
"lessThan": "0ca49fbd2883cd53d32d85b50feef17fa04d0fbf"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"versions": [
{
"version": "4.5",
"status": "affected"
},
{
"version": "0",
"status": "unaffected",
"versionType": "semver",
"lessThan": "4.5"
},
{
"version": "5.10.270",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"version": "5.15.221",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"version": "6.1.188",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"version": "6.6.157",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"version": "6.12.110",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"version": "6.18.51",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"version": "7.2.5",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"version": "7.3",
"status": "unaffected",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
]
}
]
}
}
}