Linux Kernel KVM EUVD-2026-30019

This affects the Linux kernel's KVM subsystem on AMD processors utilizing SVM (Secure Virtual Machine) extensions with AVIC (Advanced Virtual Interrupt Controller) enabled. AVIC is AMD's hardware mechanism for accelerating APIC interrupt virtualization, bypassing hypervisor software for interrupt delivery. CR8 is the x86 Task Priority Register (TPR), which controls which interrupt priority levels are delivered to a CPU. KVM normally intercepts CR8 writes in software when AVIC is inactive, then clears that interception when AVIC handles TPR in hardware. The bug is a state management flaw: when AVIC is deactivated during INIT→WFS emulation and subsequently reactivated, the CR8 write interception bit is not explicitly cleared, causing KVM to continue handling TPR writes in software even though AVIC is now managing them in hardware. This dual-path TPR management causes the hardware-visible TPR to diverge from the guest's expected state. The fix adds explicit set/clear of CR8 write interception on AVIC (de)activation transitions. Intel VMX is architecturally immune because TPR_THRESHOLD is ignored whenever Virtual Interrupt Delivery (APICv) is active. CWE is not classified in the input data, but this represents a control flow state management flaw (analogous to CWE-664). Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.