CVE-2026-23005

This vulnerability in the Linux kernel, CVE-2026-23005, affects the x86 FPU (Floating Point Unit) and KVM (Kernel-based Virtual Machine) by causing a kernel panic. Specifically, it occurs when the guest's XSAVE state is loaded or updated, and the XSTATE_BV (Extended State Save Area) indicates a feature is enabled while the XFD (Extended Feature Disable) register indicates it's disabled. This mismatch leads to a "Device Not Available" exception and a system crash. The severity is moderate, as it can lead to a denial of service (kernel panic) within a virtualized environment. The attack vector involves a malicious guest VM or userspace manipulating the XSAVE state or XFD register, potentially causing instability for the host. The complexity appears to be low to moderate, requiring specific conditions related to guest FPU state management. There is currently no evidence of active exploitation, and no exploit code is publicly available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion is minimal, with only one mention, and media coverage is limited to a single security update notice from openSUSE.