[BUG] Virtual Box DKMS causing kernel panic

[wolfyrion]

Pre-flight checklist

• I have searched existing issues and this is not a duplicate.
• I have read the Contributing Guidelines.
• I have verified the issue is reproducible with the latest available CachyOS kernel.
• I have tried to reproduce the issue on Arch Linux's linux kernel.

Upstream / vanilla kernel check

I have not tested with a vanilla/upstream kernel

Kernel variant

linux-cachyos (EEVDF, Clang)

System information (cachyos-bugreport.sh)

System:
  Kernel: 6.18.22-1-cachyos-lts arch: x86_64 bits: 64 compiler: gcc v: 15.2.1
  Desktop: GNOME v: 50.1 Distro: CachyOS base: Arch Linux
Machine:
  Type: Laptop System: HP product: HP ZBook Firefly 15 inch G8 Mobile
    Workstation PC v: SBKPFV3 serial: <superuser required>
  Mobo: HP model: 8846 v: KBC Version 30.57.00 serial: <superuser required>
    Firmware: UEFI vendor: HP v: T76 Ver. 01.23.00 date: 11/06/2025
Battery:
  ID-1: BAT0 charge: 40.5 Wh (99.3%) condition: 40.8/56 Wh (72.8%)
    volts: 12.44 min: 11.55 model: Hewlett-Packard Primary status: not charging
CPU:
  Info: quad core model: 11th Gen Intel Core i7-1185G7 bits: 64 type: MT MCP
    arch: Tiger Lake rev: 1 cache: L1: 320 KiB L2: 5 MiB L3: 12 MiB
  Speed (MHz): avg: 4142 min/max: 400/4800 cores: 1: 4142 2: 4142 3: 4142
    4: 4142 5: 4142 6: 4142 7: 4142 8: 4142 bogomips: 47923
  Flags-basic: avx avx2 ht lm nx pae sse sse2 sse3 sse4_1 sse4_2 ssse3 vmx
Graphics:
  Device-1: Intel TigerLake-LP GT2 [Iris Xe Graphics] vendor: Hewlett-Packard
    driver: i915 v: kernel arch: Xe bus-ID: 0000:00:02.0
  Device-2: NVIDIA TU117GLM [Quadro T500 Mobile] vendor: Hewlett-Packard
    driver: nvidia v: 595.58.03 arch: Turing bus-ID: 0000:01:00.0
  Device-3: ARC Camera driver: hid-generic,snd-usb-audio,usbhid,uvcvideo
    type: USB bus-ID: 3-5.3.1:12
  Display: wayland server: X.Org v: 24.1.10 with: Xwayland v: 24.1.10
    compositor: gnome-shell driver: gpu: i915 resolution: 1: 2560x1440~60Hz
    2: 2560x1440~60Hz
  API: EGL v: 1.5 drivers: iris,swrast platforms:
    active: wayland,x11,surfaceless,device inactive: gbm,device-0
  API: OpenGL v: 4.6 compat-v: 4.5 vendor: intel mesa v: 26.0.5-arch2.3
    glx-v: 1.4 direct-render: yes renderer: Mesa Intel Iris Xe Graphics (TGL
    GT2)
  API: Vulkan v: 1.4.341 drivers: intel,nvidia surfaces: N/A devices: 2
  Info: Tools: api: eglinfo, glxinfo, vulkaninfo
    gpu: nvidia-settings,nvidia-smi x11: xdpyinfo, xprop, xrandr
Audio:
  Device-1: Intel 500 Series Family On-Package High Definition Audio
    vendor: Hewlett-Packard driver: sof-audio-pci-intel-tgl bus-ID: 0000:00:1f.3
  Device-2: HP USB Audio driver: hid-generic,snd-usb-audio,usbhid type: USB
    bus-ID: 3-5.2:8
  Device-3: ARC Camera driver: hid-generic,snd-usb-audio,usbhid,uvcvideo
    type: USB bus-ID: 3-5.3.1:12
  Device-4: Logitech H390 headset with microphone
    driver: hid-generic,snd-usb-audio,usbhid type: USB bus-ID: 3-5.3.2:13
  API: ALSA v: k6.18.22-1-cachyos-lts status: kernel-api
  Server-1: sndiod v: N/A status: off
  Server-2: JACK v: 1.9.22 status: off
  Server-3: PipeWire v: 1.6.3 status: active
Network:
  Device-1: Intel Wi-Fi 6 AX201 driver: iwlwifi v: kernel bus-ID: 0000:00:14.3
  IF: wlan0 state: up mac: <filter>
  Device-2: Realtek RTL8153 Gigabit Ethernet Adapter driver: r8152 type: USB
    bus-ID: 2-1.4:4
  IF: enp0s13f0u1u4 state: up speed: 1000 Mbps duplex: full mac: <filter>
Bluetooth:
  Device-1: Intel AX201 Bluetooth driver: btusb v: 0.8 type: USB
    bus-ID: 3-10:9
  Report: btmgmt ID: hci0 rfk-id: 0 state: up address: <filter> bt-v: 5.2
    lmp-v: 11
RAID:
  Hardware-1: Intel Volume Management Device NVMe RAID Controller driver: vmd
    v: 0.6 bus-ID: 0000:00:0e.0
Drives:
  Local Storage: total: 1.82 TiB used: 1.43 TiB (78.7%)
  ID-1: /dev/nvme0n1 vendor: Western Digital model: WD BLACK SN850X 2000GB
    size: 1.82 TiB temp: 35.9 C
Partition:
  ID-1: / size: 1.79 TiB used: 1.43 TiB (80.0%) fs: ext4 dev: /dev/nvme0n1p2
  ID-2: /boot size: 2 GiB used: 751.7 MiB (36.8%) fs: vfat
    dev: /dev/nvme0n1p1
Swap:
  ID-1: swap-1 type: zram size: 31.11 GiB used: 0 KiB (0.0%) dev: /dev/zram0
Sensors:
  System Temperatures: cpu: 57.0 C mobo: N/A
  Fan Speeds (rpm): N/A
Info:
  Memory: total: 32 GiB note: est. available: 31.11 GiB used: 18 GiB (57.9%)
  Processes: 377 Uptime: 2h 45m Init: systemd
  Packages: 1681 Compilers: clang: 22.1.3 gcc: 15.2.1 Shell: fish v: 4.6.0
    inxi: 3.3.40

Manual system information (if cachyos-bugreport.sh is unavailable)

Bug description

I have installed today the updates of Virtual BOX DKMS Drivers and it seems to cause kernel panics

I have posted screenshots on Reddit
https://www.reddit.com/r/cachyos/comments/1ssa7e9/issues_with_cachyos_kernels_lts_as_well_this_is/

Steps to reproduce

1. Just update the latest Virtual Box drivers and reboot to latest Cachyos Kernel

Expected behavior

to boot Normaly

Actual behavior

kernel panic

Logs / stack traces

Additional system information

No response

[wolfyrion]

cachyos-bugreport.sh

https://paste.cachyos.org/p/b74c2a3.log

[Ishidawg]

I had this same (looks the same, but I can be wrong) issue today. I also had VirtualBox installed, but then I uninstalled it, upgrade my system (sudo pacman -Syu) and got this error. I made a search upon it but I'm not an expert to say this is correct.

intel cpu have an "security mode" (Indirect Branch Tracking) when booting up your system that prevents memory injection while booting, the new nvidia driver is making this to trigger (I don't know why), then it prevents the system from booting. You can go to your boot manager (before loading the system) and disable this temporarily by adding itb=off to end of your kernel parameters.

Specs:

• CachyOS
• KDE latest version
• NVIDIA RTX 5070 (NVIDIA-SMI 595.58.03, Driver Version: 595.58.03, CUDA Version: 13.2)
• Intel i5 14600KF
• 48GB RAM

I never had this issue before.

more info:

 λ  ~ ➜ pacman -Qs virtualbox
local/linux-cachyos 7.0.0-1
    The Linux EEVDF + LTO + AutoFDO + Propeller Cachy Sauce Kernel by CachyOS with other patches and improvements. kernel and modules
local/linux-cachyos-lts 6.18.22-1
    The Linux BORE + Cachy Sauce Kernel by CachyOS with other patches and improvements - Long Term Service kernel and modules
local/virtualbox-host-dkms 7.2.8-1
    VirtualBox Host kernel modules sources
 λ  ~ ➜ dkms status
vboxhost/7.2.8_OSE, 6.18.22-1-cachyos-lts, x86_64: installed
vboxhost/7.2.8_OSE, 7.0.0-1-cachyos, x86_64: installed

obs: If this is another issue, then forgive me. I can create a new issue.

Error:

[ptr1337]

Really odd. Does downgrading virtual-host-box-dkms fix it?

[Ishidawg]

Well, I did not tried it. Cuz I have removed virtual-box, but the dkms driver was left behind. So when I see this post, I just uninstall it.

Also, another user from r/LinuxBrasil that uses cachyOS had the same problem. I help him fix it.

But as I said, using ibt=off on kernel params makes the system boots normally (if you have the virtual-box dkms driver).

[DeflateAwning]

Maybe this is all the wrong approach (still new at debugging kernel things), but I wanted to see if I could figure out how to diagnose this.

I started by looking into whether the vbox kernel module has IBT instructions within it for confirmation. Conclusion, it does.

Details

zstd -d /lib/modules/7.0.0-1-cachyos/updates/dkms/vboxdrv.ko.zst -o /tmp/vboxdrv.ko

# Check for IBT note in ELF properties
readelf -n /tmp/vboxdrv.ko | grep -i ibt
# Result (yes):       Properties: x86 feature: IBT

# Check for endbr64 instructions (IBT landing pads)
objdump -d /tmp/vboxdrv.ko | grep endbr64 | wc -l
# Result: 675

# Compare total function count vs endbr64 count
objdump -d /tmp/vboxdrv.ko | grep -c "^[0-9a-f]* <"
# Result: 1499

And basically the same results when I checked the 6.18.24-1-lts kernel module.

Then, I looked at whether the vmlinuz kernel has IBT endbr64 instructions:

extract-vmlinuz vmlinuz-7.0.0-1-cachyos > vmlinuz-7.0.0-1-cachyos.elf

objdump -d vmlinuz-7.0.0-1-cachyos.elf | grep endbr64 | wc -l
# Result: 56320

Conclusion: Yes. So I guess it's just the specific branch end location that the vbox kernel jumps back to that's missing?

Interesting comment from the Discord:

Likely cause: both kernels have CONFIG_X86_KERNEL_IBT=y, but stock Arch is gcc-built and CachyOS is clang+LTO (clang 22.1.3, LLD 22.1.3). It looks like clang-LTO is stripping the ENDBR prologue from
kallsyms_lookup_name since it's not indirect-called from within the kernel itself. vboxdrv indirect-calls it via RTR0DbgKrnlInfoQuerySymbol, and IBT fires only on the CachyOS builds.

[DeflateAwning]

Pretty sure this is the bad commit in Virtualbox that caused this mess: VirtualBox/virtualbox@29fa63f

I've opened an issue with VirtualBox: VirtualBox/virtualbox#644

[ptr1337]

Can you please check if the fix is working? sudo pacman -Syu should be aame:

virtualbox-7.2.8-2-x86_64.pkg.tar.zst

[wolfyrion]

Can you please check if the fix is working? sudo pacman -Syu should be aame:

virtualbox-7.2.8-2-x86_64.pkg.tar.zst

is booting fine with the new update but one thing that I dont understand is why with Cachyos-Kernel my mouse pointer gets Enlarged while moving windows but this is not happening with Arch or Xanmod kernel ?????

[ptr1337]

Can you please check if the fix is working? sudo pacman -Syu should be aame:
virtualbox-7.2.8-2-x86_64.pkg.tar.zst

is booting fine with the new update but one thing that I dont understand is why with Cachyos-Kernel my mouse pointer gets Enlarged while moving windows but this is not happening with Arch or Xanmod kernel ?????

Thats weird. Tried to reproduce it, but can not. Can you maybe make a video?

[DeflateAwning]

@ptr1337 virtualbox-7.2.8-2-x86_64.pkg.tar.zst fixes the issue, very nice.

Am still new to the community - where is that patch visible for packages like that? I'm curious what changed.

[ptr1337]

@ptr1337 virtualbox-7.2.8-2-x86_64.pkg.tar.zst fixes the issue, very nice.

Am still new to the community - where is that patch visible for packages like that? I'm curious what changed.

I just made a local patch, since I hope archlinux will adapt it :)

here is the patch:

diff --git a/src/VBox/Runtime/r0drv/linux/dbgkrnlinfo-r0drv-linux.c b/src/VBox/Runtime/r0drv/linux/dbgkrnlinfo-r0drv-linux.c
index 9a0f7b2..1e77586 100644
--- a/src/VBox/Runtime/r0drv/linux/dbgkrnlinfo-r0drv-linux.c
+++ b/src/VBox/Runtime/r0drv/linux/dbgkrnlinfo-r0drv-linux.c
@@ -61,6 +61,7 @@
 #include <iprt/dbg.h>

 #include <iprt/asm.h>
+#include <iprt/asm-amd64-x86.h>
 #include <iprt/assert.h>
 #include <iprt/ctype.h>
 #include <iprt/err.h>
@@ -67,6 +68,7 @@
 #include <iprt/file.h>
 #include <iprt/mem.h>
 #include <iprt/string.h>
+#include <iprt/thread.h>
 #include "internal/magics.h"


@@ -86,6 +88,18 @@
 #endif


+#define X86_CPUID_STEXT_FEATURE_EDX_CET_IBT RT_BIT_32(20)
+#ifndef MSR_IA32_S_CET
+# define MSR_IA32_S_CET                     0x6a2
+#endif
+#ifndef MSR_IA32_CET_ENDBR_EN
+# define MSR_IA32_CET_ENDBR_EN              RT_BIT_64(2)
+#endif
+#ifndef MSR_IA32_CET_SUPPRESS
+# define MSR_IA32_CET_SUPPRESS              RT_BIT_64(10)
+#endif
+
+
 /*********************************************************************************************************************************
 *   Structures and Typedefs                                                                                                      *
 *********************************************************************************************************************************/
@@ -577,7 +591,29 @@ static int rtR0DbgKrnlInfoLnxQuerySymbol(const char *pszSymbol, void **ppvSymbol
     if (!g_pfnKallsymsLookupName)
         return rtR0DbgKrnlInfoLnxQuerySymbolKprobe(pszSymbol, ppvSymbol);

-    if ((*ppvSymbol = (void *)g_pfnKallsymsLookupName(pszSymbol)) != NULL)
+    /*
+     * Note! kallsyms_lookup_name isn't exported, so we have to temporarily disable the
+     *       indirect branch track machinery in order to call it safely.
+     *       (Setting the SUPPRESS bit to 1 probably won't help much here, as
+     *       the call is done via __x86_indirect_thunk_xxx.)
+     */
+    RTTHREADPREEMPTSTATE Preempt = RTTHREADPREEMPTSTATE_INITIALIZER;
+    uint32_t const uLeaves = ASMCpuId_EAX(0);
+    RTThreadPreemptDisable(&Preempt);
+    if (   uLeaves >= 7
+        && RTX86IsValidStdRange(uLeaves)
+        && (ASMCpuIdEx_EDX(7, 0) & X86_CPUID_STEXT_FEATURE_EDX_CET_IBT))
+    {
+        uint64_t const fSupCet = ASMRdMsr(MSR_IA32_S_CET);
+        ASMWrMsr(MSR_IA32_S_CET, fSupCet & ~MSR_IA32_CET_ENDBR_EN);
+        *ppvSymbol = (void *)g_pfnKallsymsLookupName(pszSymbol);
+        ASMWrMsr(MSR_IA32_S_CET, fSupCet);
+    }
+    else
+        *ppvSymbol = (void *)g_pfnKallsymsLookupName(pszSymbol);
+    RTThreadPreemptRestore(&Preempt);
+
+    if (*ppvSymbol != NULL)
         return VINF_SUCCESS;
 #endif