CVE-2020-27152: An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2.

Security readout for executives and security teams

This CVE affects the Linux kernel’s KVM virtualization code. A bug in IOAPIC interrupt handling can cause an infinite loop and is described in the public mailing-list reference as a host stack overflow condition. Organizations running KVM on vulnerable kernels should treat affected virtualization hosts as the main concern. Exposure is most likely on Linux systems running KVM virtualization with kernels older than 5.9.2 or without the referenced backport. The bundle does not identify specific distributions, cloud platforms, or appliance products. Prioritize this where KVM hosts support production or multi-tenant workloads. Severity scoring is absent, but the affected component sits at the virtualization host layer, so unresolved exposure can carry outsized operational risk. Mitigation focus: Update affected Linux kernels to 5.9.2 or a vendor-supported fixed release.; Confirm vendor advisories for backported fixes on long-term or distribution kernels.; Prioritize internet-facing or multi-tenant KVM virtualization hosts..

Prepared

Jun 5, 2026, 13:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.