In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Move the handling of fastpath userspace exits into vendor code to ensure KVM runs vendor specific operations that need to run before userspace gains control of the vCPU. E.g. for VMX (and soon to be for SVM as well), KVM needs to flush the PML buffer prior to exiting to userspace, otherwise any memory written by the final KVM_RUN might never be flagged as dirty. Note, waiting to snapshot CR0 and CR3 until svm_handle_exit() is flawed in general, as that risks consuming stale state in a fastpath handler. That will be addressed in a future change.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-64284 is a kernel-level vulnerability in KVM's x86 virtualization handler that fails to execute vendor-specific operations before returning control to userspace. Specifically, the PML (Page Modification Logging) buffer flush for VMX and SVM is not executed when taking fastpath userspace exits, potentially allowing memory writes to bypass proper logging and detection mechanisms. This affects Linux systems running KVM hypervisors with virtual machines, particularly impacting cloud infrastructure, container platforms, and any environment relying on KVM-based virtualization where memory integrity monitoring is critical for security.
While Casky.ai currently has zero mapped skills for this specific CVE, the vulnerability pattern relates to improper resource handling and state management during privilege transitions—areas that would typically be detected through behavioral analysis of kernel code paths and VM exit sequences. A practitioner using Casky's extended reasoning capabilities would look for anomalies in vCPU state transitions, specifically gaps where vendor-specific cleanup operations are skipped before userspace regains control. Detection would focus on identifying when memory modification logs diverge from actual guest memory writes, particularly around KVM_RUN syscall boundaries where the PML flush should occur. This represents a subtle logic error in the VM exit path rather than a traditional exploit technique, making it detectable through code flow analysis and state consistency checking rather than signature-based MITRE ATT&CK mappings.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-64284. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation