Skip to content

nestedVirtualization silently disabled: HCS ProcessorCapabilities query fails with 0x8007000D on 26100.9711 (Oct 2026 CU), WSL swallows error #41917

Open
#41942
Open
nestedVirtualization silently disabled: HCS ProcessorCapabilities query fails with 0x8007000D on 26100.9711 (Oct 2026 CU), WSL swallows error#41917
#41942
Assignees
benhilliscopilot-swe-agent
Labels
fixinboundwsl2Issue/feature applies to WSL 2

Description

@timusus
Tim Malseed (timusus)
opened on Oct 14, 2026

Windows Version

Microsoft Windows [Version 10.0.26200.9711] (Oct 2026 CU, Package_for_RollupFix 26100.9711.1.30)

WSL Version

3.0.3.0

Are you using WSL 1, WSL 2, or WSLC?

  • WSL 2
  • WSL 1
  • WSLC

Kernel Version

6.18.54.1-microsoft-standard-WSL2

Distro Version

Ubuntu 22.04

Other Software

AMD Ryzen 7 3700X (Zen 2), SVM enabled in firmware. VirtualMachinePlatform + HypervisorPlatform enabled; full Hyper-V not installed. VBS running with no security services (no HVCI/Credential Guard).

Repro Steps

  1. Windows 11 host on build 26100/26200.9711 (October 2026 cumulative update), AMD CPU.
  2. %UserProfile%\.wslconfig: 
    [wsl2]
nestedVirtualization=true
  3. wsl --shutdown, start a distro.
  4. In the guest: ls /dev/kvm; grep -Ec 'vmx|svm' /proc/cpuinfo; dmesg | grep -i 'nested features'

Expected Behavior

Guest sees SVM and /dev/kvm exists (this worked on this machine before the October update). If nested virtualization really is unavailable, wsl.exe should at least print MessageNestedVirtualizationNotSupported.

Actual Behavior

ls: cannot access '/dev/kvm': No such file or directory
0
[    0.000000] Hyper-V: Nested features: 0x0

modprobe kvm_amd -> SVM not supported by CPU. wsl.exe prints no warning.

Diagnostic Logs

Root cause appears to be an HCS regression that WSL silently swallows.

WslCoreVm.cpp (~L1595) gates ExposeVirtualizationExtensions on hcs::GetProcessorFeatures() containing "NestedVirt". That function issues exactly this query, which now fails on this build:

HcsGetServiceProperties('{ "PropertyQueries": {"ProcessorCapabilities" : {}}}')
-> hr=0x8007000D {"Error":-2147024883,"ErrorMessage":"The data is invalid."}

For comparison on the same host:

{"PropertyQueries":{"Basic":{}}}                    -> S_OK, SupportedSchemaVersions [2.11]
{"PropertyQueries":{"ContainerCredentialGuard":{}}} -> S_OK
{"PropertyQueries":{"ProcessorFeatures":{}}}        -> 0x80070057 (unknown property)
{"PropertyQueries":{"ProcessorCapabilities":{}}}    -> 0x8007000D (known property, fails internally)

Because the call is wrapped in CATCH_LOG(), the exception is only logged and:

  • vmSettings.ComputeTopology.Processor.ExposeVirtualizationExtensions is never set (omitted from the HCS document),
  • m_vmConfig.EnableNestedVirtualization stays 1 (CreateVmBegin/CreateVmEnd events from the lxcore_service provider both report EnableNestedVirtualization = 1),
  • EMIT_USER_WARNING(MessageNestedVirtualizationNotSupported) is skipped.

Hyper-V-Worker-Admin event 18609 for the WSL VM shows Partition creation flags: 0x8001000044120 (no nested-capable flag).

Ruled out: .wslconfig is being read (memory setting applies); no WSL policy keys; firmware SVM enabled (VirtualizationFirmwareEnabled=True); all Hyper-V binaries consistently at 10.0.26100.9711; sfc /verifyonly clean; hardwarePerformanceCounters=false makes no difference.

Asks:

  1. HCS: the ProcessorCapabilities service property query appears to have regressed in 26100.9711 (fails with ERROR_INVALID_DATA).
  2. WSL: when GetProcessorFeatures() throws, emit a user warning instead of silently dropping nested virtualization (or fall back to requesting ExposeVirtualizationExtensions and let HCS reject it).

Related: #40735 (same code path, Windows 10).

Activity

  1. github-actions commented on Oct 14, 2026

    @github-actions
    github-actionsbot
    on Oct 14, 2026 – with GitHub Actions
    Contributor

    Logs are required for review from WSL team

    If this a feature request, please reply with '/feature'. If this is a question, reply with '/question'.
    Otherwise, please attach logs by following the instructions below, your issue will not be reviewed unless they are added. These logs will help us understand what is going on in your machine.

    How to collect WSL logs

    Download and execute collect-wsl-logs.ps1 in an administrative powershell prompt:

    Invoke-WebRequest -UseBasicParsing "https://raw.githubusercontent.com/microsoft/WSL/master/diagnostics/collect-wsl-logs.ps1" -OutFile collect-wsl-logs.ps1
Set-ExecutionPolicy Bypass -Scope Process -Force
.\collect-wsl-logs.ps1

    The script will output the path of the log file once done.

    If this is a networking issue, please use .\collect-wsl-logs.ps1 -LogProfile networking instead, following the instructions in Collect WSL logs for networking issues

    Once completed please upload the output files to this GitHub issue.

    See Collect WSL logs (recommended method).

    If you choose to email these logs instead of attaching them to the bug, please send them to wsl-gh-logs@microsoft.com with the GitHub issue number in the subject, and include a link to your GitHub issue comment in the message body, and reply with '/emailed-logs'.

  2. github-actions
    added
    needs-author-feedback
    on Oct 14, 2026

  3. boostd commented on Oct 14, 2026

    @boostd
    Jürgen Tihanov (boostd)
    on Oct 14, 2026

    We also ran into this. The issue also happened on my coworkers laptop, uninstalling KB5127648 immediately fixed it.
    Also it might only be affecting AMD CPUs, another coworker applied the update and did not encounter any issues.

    Affected AMD CPU: AMD Ryzen 5 PRO 8640HS w/ Radeon 760M Graphics
    Unaffected Intel CPU: Intel(R) Core(TM) Ultra 7 155H

  4. samerelmaz commented on Oct 14, 2026

    @samerelmaz
    Samer El Mazry (samerelmaz)
    on Oct 14, 2026

    Also ran into this. Can confirm uninstalling KB5127648 fixed the issue. Affected CPU: AMD Ryzen 5 7640HS w/ Radeon 760M Graphics

  5. David Bennett (dkbennett)
    added
    wsl2Issue/feature applies to WSL 2
    on Oct 14, 2026

  6. j0rg3n commented on Oct 14, 2026

    @j0rg3n
    j0rg3n
    on Oct 14, 2026

    Long detailed report assembled for me by Claude. Human TL;DR: /dev/kvm missing, discovered bc. breaking docker-sbx; restored service by uninstalling 5127649 update installed last night:

    Same problem on an AMD Ryzen 5 5600X (Zen 3), so this is not limited to Zen 2 or Zen 4. Uninstalling KB5127648 fixed it.

    Machine

    CPU: AMD Ryzen 5 5600X (6 cores, 12 threads)
    Motherboard: MSI MS-7C95, BIOS 2.M1 (UEFI)
    RAM: 16 GB
    Windows 11 Pro 25H2. Build with KB5127648 installed: 10.0.26200.9711 (kernel reports 26100.9711 in the Kernel-General boot event). Build after uninstalling it: 10.0.26200.9457.
    Updates installed on 2026-10-14: KB5127647 (servicing stack), KB5127648 (LCU), KB5127690 (.NET Framework 4.8.1 rollup). KB5129195 (security update for Windows 11 24H2/25H2) was also installed that day; it is still installed and nested virtualization works with it, so it is not the cause.
    WSL 3.0.3.0, kernel 6.18.54.1-microsoft-standard-WSL2, Ubuntu 24.04.5 LTS
    .wslconfig: [wsl2] / nestedVirtualization=true
    Memory Integrity off. VBS running with no security services configured. No third-party hypervisor drivers loaded.
    With KB5127648 installed

    No svm flag in /proc/cpuinfo inside WSL, and no /dev/kvm.
    dmesg showed Hyper-V: Nested features: 0x0, and KVM reported no hardware support because SVM was not available (has_svm: svm not available). [I didn't save the full output, apologies.]
    wsl.exe printed no warning about nested virtualization.
    No errors in the Hyper-V event logs.
    Docker Sandboxes (sbx), which runs a KVM microVM inside WSL, failed with start runtime: 500 Internal Server Error. Its daemon log said KVM is not available.

    Things that did not help
    nestedVirtualization=true in .wslconfig (it was already set) followed by wsl --shutdown
    Upgrading WSL from 2.4.13.0 (kernel 5.15.167.4) to 3.0.3.0 (kernel 6.18.54.1)
    Memory Integrity: it was already off

    Fix
    Uninstalling KB5127648 and rebooting brought back svm and /dev/kvm (crw-rw---- 1 root kvm 10, 232, 12 svm matches in /proc/cpuinfo on the 6-core/12-thread CPU), and sbx works again. Nothing else changed: same WSL 3.0.3.0, same kernel, same .wslconfig.

  7. benhillis commented on Oct 15, 2026

    @benhillis
    Ben Hillis (benhillis)
    on Oct 15, 2026
    Member

    Thanks for posting (and the duplicates). We have identified the issue with the Windows Update and are working with the servicing team to get a fix out as quickly as possible. If a temporary workaround is found (other than rolling back the KB which has other downsides) I will share it here. Thanks for your patience.

  8. Ben Hillis (benhillis)
    added
    fixinbound
    and removed
    needs-author-feedback
    on Oct 15, 2026

  9. MaKTaiL commented on Oct 15, 2026

    @MaKTaiL
    Matheus Castro (MaKTaiL)
    on Oct 15, 2026

    I can confirm the same issue with my AMD CPU. Uninstalling KB5127648 fixed it for me as well.

  10. mrpickles007 commented on Oct 15, 2026

    @mrpickles007
    mrpickles007
    on Oct 15, 2026

    I can confirm the same issue on my CPU AMD Ryzen 9 8945HS, i sent a feedback via feedback Hub by attaching logs gathered with collect-wsl-logs.ps1 while reproducing the issues.
    Fixed by uninstalling the update KB5127648

    The feedback is https://aka.ms/AA13sxp7

  11. trieu1162000 commented on Oct 15, 2026

    @trieu1162000
    Nhat-Trieu Huynh-Pham (trieu1162000)
    on Oct 15, 2026

    just ran into the same issue ~

    Environment:

    • Windows 11 Home Single Language, build 10.0.26200.9711 (KB5127648 installed 2026-10-13; KB5127647/SSU and KB5127690 also present)
    • CPU: AMD Ryzen 7 5800H (Zen 3, family 19h model 50h), SVM enabled in firmware
    • WSL 3.0.3.0; kernel 6.18.54.1-microsoft-standard-WSL2+, built locally from the Microsoft WSL config with CONFIG_KVM=m / CONFIG_KVM_AMD=m
    • VirtualMachinePlatform + HypervisorPlatform enabled (full Hyper-V not installed on Home), hypervisorlaunchtype Auto; hypervisor boots cleanly (Hyper-V-Hypervisor event ID 1, IOMMU enabled), VBS running

    Symptoms are identical to the report:

    $ grep -c svm /proc/cpuinfo        # 0
$ ls -l /dev/kvm                   # static udev node only; no kvm module loaded, kvm absent from /proc/misc
$ dmesg | grep 'Nested features'   # [0.000000] Hyper-V: Nested features: 0x0

    Hope this info below will help for analysing the root cause:
    Assisted-by: opencode : deepseek-flash-4.1

    1. Root failure: the HCS ProcessorCapabilities serializer (vmcompute.exe / computecore.dll, 10.0.26100.9711) does not handle the new processor-feature bits 59/60 that the hypervisor reports via WHvGetCapability(WHvCapabilityCodeProcessorFeaturesBanks) (its name table ends at bit 55 TsaFillNo + SentinelAmd) → HcsGetServiceProperties({... "ProcessorCapabilities" ...}) returns 0x8007000D (consistent with the analysis in Nested virtualization silently disabled on AMD Zen 2 after KB5127648: HCS ProcessorCapabilities query fails with 0x8007000D (unknown processor feature bits 59/60) #41918).
    2. WSL then swallows it: hcs.cpp L112–135 (THROW_IF_FAILED(HcsGetServiceProperties(...)) at L120) throws, and WslCoreVm.cpp L1596–1618 catches with CATCH_LOG() (L1617), so ExposeVirtualizationExtensions (L1611) is never set and the warning (L1614) is never reached.
  12. Ben Hillis (benhillis)
    assigned
    Ben Hillis (benhillis)
    and
    Copilot
    on Oct 15, 2026
  13. Copilot
    linked a pull request that will close this issueWarn when nested virtualization capability detection fails #41942on Oct 15, 2026

  14. ttPolG commented on Oct 16, 2026

    @ttPolG
    ttPolG
    on Oct 16, 2026

    I'm experiencing the same issue on a system with an AMD Ryzen 5 8645HS.

    System information

    • CPU: AMD Ryzen 5 8645HS (Radeon 760M Graphics)
    • OS: Windows 11 Home, build 10.0.26200.9711
    • Recent Windows updates: KB5127648, KB5127647, KB5127690
    • WSL version: 3.0.3.0 (previously 3.0.1.0)
    • WSL kernel: 6.18.54.1-microsoft-standard-WSL2 (previously 6.18.40.1)
    • Docker Desktop: WSL2 backend
    • VirtualizationFirmwareEnabled: True
    • HypervisorPresent: True
    • VirtualMachinePlatform: Enabled
    • VBS status: 2 (running)
    • HVCI: Enabled and running (SecurityServicesConfigured = {2}, SecurityServicesRunning = {2})

    Issue

    After installing Windows updates and rebooting, my KVM-dependent Docker environment stopped starting.

    Running modprobe kvm_amd inside the docker-desktop WSL2 distribution fails with:

    modprobe: can't load module kvm_amd (kernel/arch/x86/kvm/kvm-amd.ko): Not supported

    The kernel logs show:

    kvm_amd: SVM not supported by CPU 2
kvm_amd: SVM not supported by CPU 10
kvm_amd: SVM not supported by CPU 4

    Additional findings

    • /dev/kvm is missing.
    • The svm CPU flag is absent from /proc/cpuinfo.
    • The kvm_amd module is present and matches the running kernel (modinfo kvm_amd works).
    • Setting nestedVirtualization=true in %USERPROFILE%.wslconfig, running wsl --shutdown, and restarting Docker Desktop did not resolve the issue.
    • No relevant errors or warnings were found in the Hyper-V-Compute-Admin event log.

    Additional context

    My environment is configured to require KVM for isolated code execution.

    I noticed the issue after installing Windows updates and rebooting. However, I didn't run a KVM execution test immediately before updating, so I can't independently confirm the exact point at which KVM stopped working.

    I haven't uninstalled KB5127648, as I'd prefer to keep the Windows security updates installed and wait for an official fix.

    Hopefully these details help identify the issue.

  15. kerbe commented on Oct 16, 2026

    @kerbe
    kerbe
    on Oct 16, 2026

    On an AMD Ryzen 9 7945HX, the rollback fails: Startup Repair says 'recently serviced boot binary is corrupt'.

    So I am unable to get KB5127648 uninstalled and resume working, until this update gets fixed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

fixinboundwsl2Issue/feature applies to WSL 2

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions