CVE-2021-29657: arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD KVM guest...

Security readout for executives and security teams

A flaw in Linux KVM on AMD systems could let a guest in a nested-virtualization setup bypass protections around host model-specific registers. This mainly concerns virtualization platforms, cloud labs, and hosts running untrusted nested guests. The record points to a Linux kernel fix by 5.11.12, with no KEV-backed active exploitation signal. Exposure is likely limited to AMD-based Linux KVM hosts using nested virtualization, especially where guests are untrusted or tenant-controlled. Standard non-virtualized Linux systems and KVM hosts without nested SVM use are less likely to be affected based on the provided description. Prioritize remediation for virtualization infrastructure that hosts untrusted workloads. The impact can cross guest-host trust boundaries, but exposure is conditional and no active exploitation evidence is provided. Treat as high priority for cloud, lab, and service-provider environments. Mitigation focus: Upgrade affected Linux kernels to 5.11.12 or vendor-supported fixed builds.; Prioritize AMD KVM hosts that allow nested virtualization for untrusted guests.; Disable nested virtualization for untrusted workloads until fixed, where operationally feasible..

Prepared

Jun 2, 2026, 19:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.