Repository navigation
nestedVirtualization silently disabled: HCS ProcessorCapabilities query fails with 0x8007000D on 26100.9711 (Oct 2026 CU), WSL swallows error #41917
Description
Windows Version
Microsoft Windows [Version 10.0.26200.9711] (Oct 2026 CU, Package_for_RollupFix 26100.9711.1.30)
WSL Version
3.0.3.0
Are you using WSL 1, WSL 2, or WSLC?
- WSL 2
- WSL 1
- WSLC
Kernel Version
6.18.54.1-microsoft-standard-WSL2
Distro Version
Ubuntu 22.04
Other Software
AMD Ryzen 7 3700X (Zen 2), SVM enabled in firmware. VirtualMachinePlatform + HypervisorPlatform enabled; full Hyper-V not installed. VBS running with no security services (no HVCI/Credential Guard).
Repro Steps
- Windows 11 host on build 26100/26200.9711 (October 2026 cumulative update), AMD CPU.
%UserProfile%\.wslconfig:[wsl2] nestedVirtualization=truewsl --shutdown, start a distro.- In the guest:
ls /dev/kvm; grep -Ec 'vmx|svm' /proc/cpuinfo; dmesg | grep -i 'nested features'
Expected Behavior
Guest sees SVM and /dev/kvm exists (this worked on this machine before the October update). If nested virtualization really is unavailable, wsl.exe should at least print MessageNestedVirtualizationNotSupported.
Actual Behavior
ls: cannot access '/dev/kvm': No such file or directory
0
[ 0.000000] Hyper-V: Nested features: 0x0
modprobe kvm_amd -> SVM not supported by CPU. wsl.exe prints no warning.
Diagnostic Logs
Root cause appears to be an HCS regression that WSL silently swallows.
WslCoreVm.cpp (~L1595) gates ExposeVirtualizationExtensions on hcs::GetProcessorFeatures() containing "NestedVirt". That function issues exactly this query, which now fails on this build:
HcsGetServiceProperties('{ "PropertyQueries": {"ProcessorCapabilities" : {}}}')
-> hr=0x8007000D {"Error":-2147024883,"ErrorMessage":"The data is invalid."}
For comparison on the same host:
{"PropertyQueries":{"Basic":{}}} -> S_OK, SupportedSchemaVersions [2.11]
{"PropertyQueries":{"ContainerCredentialGuard":{}}} -> S_OK
{"PropertyQueries":{"ProcessorFeatures":{}}} -> 0x80070057 (unknown property)
{"PropertyQueries":{"ProcessorCapabilities":{}}} -> 0x8007000D (known property, fails internally)
Because the call is wrapped in CATCH_LOG(), the exception is only logged and:
vmSettings.ComputeTopology.Processor.ExposeVirtualizationExtensionsis never set (omitted from the HCS document),m_vmConfig.EnableNestedVirtualizationstays 1 (CreateVmBegin/CreateVmEndevents from the lxcore_service provider both reportEnableNestedVirtualization = 1),EMIT_USER_WARNING(MessageNestedVirtualizationNotSupported)is skipped.
Hyper-V-Worker-Admin event 18609 for the WSL VM shows Partition creation flags: 0x8001000044120 (no nested-capable flag).
Ruled out: .wslconfig is being read (memory setting applies); no WSL policy keys; firmware SVM enabled (VirtualizationFirmwareEnabled=True); all Hyper-V binaries consistently at 10.0.26100.9711; sfc /verifyonly clean; hardwarePerformanceCounters=false makes no difference.
Asks:
- HCS: the
ProcessorCapabilitiesservice property query appears to have regressed in 26100.9711 (fails with ERROR_INVALID_DATA). - WSL: when
GetProcessorFeatures()throws, emit a user warning instead of silently dropping nested virtualization (or fall back to requesting ExposeVirtualizationExtensions and let HCS reject it).
Related: #40735 (same code path, Windows 10).
Activity
github-actions commentedon Oct 14, 2026
Logs are required for review from WSL team
If this a feature request, please reply with '/feature'. If this is a question, reply with '/question'.
Otherwise, please attach logs by following the instructions below, your issue will not be reviewed unless they are added. These logs will help us understand what is going on in your machine.
How to collect WSL logs
Download and execute collect-wsl-logs.ps1 in an administrative powershell prompt:
The script will output the path of the log file once done.
If this is a networking issue, please use
.\collect-wsl-logs.ps1 -LogProfile networkinginstead, following the instructions in Collect WSL logs for networking issuesOnce completed please upload the output files to this GitHub issue.
See Collect WSL logs (recommended method).
If you choose to email these logs instead of attaching them to the bug, please send them to wsl-gh-logs@microsoft.com with the GitHub issue number in the subject, and include a link to your GitHub issue comment in the message body, and reply with '/emailed-logs'.
boostd commentedon Oct 14, 2026
We also ran into this. The issue also happened on my coworkers laptop, uninstalling KB5127648 immediately fixed it.
Also it might only be affecting AMD CPUs, another coworker applied the update and did not encounter any issues.
Affected AMD CPU:
AMD Ryzen 5 PRO 8640HS w/ Radeon 760M GraphicsUnaffected Intel CPU:
Intel(R) Core(TM) Ultra 7 155Hsamerelmaz commentedon Oct 14, 2026
Also ran into this. Can confirm uninstalling KB5127648 fixed the issue. Affected CPU: AMD Ryzen 5 7640HS w/ Radeon 760M Graphics
j0rg3n commentedon Oct 14, 2026
Long detailed report assembled for me by Claude. Human TL;DR: /dev/kvm missing, discovered bc. breaking docker-sbx; restored service by uninstalling 5127649 update installed last night:
Same problem on an AMD Ryzen 5 5600X (Zen 3), so this is not limited to Zen 2 or Zen 4. Uninstalling KB5127648 fixed it.
Machine
CPU: AMD Ryzen 5 5600X (6 cores, 12 threads)
Motherboard: MSI MS-7C95, BIOS 2.M1 (UEFI)
RAM: 16 GB
Windows 11 Pro 25H2. Build with KB5127648 installed: 10.0.26200.9711 (kernel reports 26100.9711 in the Kernel-General boot event). Build after uninstalling it: 10.0.26200.9457.
Updates installed on 2026-10-14: KB5127647 (servicing stack), KB5127648 (LCU), KB5127690 (.NET Framework 4.8.1 rollup). KB5129195 (security update for Windows 11 24H2/25H2) was also installed that day; it is still installed and nested virtualization works with it, so it is not the cause.
WSL 3.0.3.0, kernel 6.18.54.1-microsoft-standard-WSL2, Ubuntu 24.04.5 LTS
.wslconfig: [wsl2] / nestedVirtualization=true
Memory Integrity off. VBS running with no security services configured. No third-party hypervisor drivers loaded.
With KB5127648 installed
No svm flag in /proc/cpuinfo inside WSL, and no /dev/kvm.
dmesg showed Hyper-V: Nested features: 0x0, and KVM reported no hardware support because SVM was not available (has_svm: svm not available). [I didn't save the full output, apologies.]
wsl.exe printed no warning about nested virtualization.
No errors in the Hyper-V event logs.
Docker Sandboxes (sbx), which runs a KVM microVM inside WSL, failed with start runtime: 500 Internal Server Error. Its daemon log said KVM is not available.
Things that did not help
nestedVirtualization=true in .wslconfig (it was already set) followed by wsl --shutdown
Upgrading WSL from 2.4.13.0 (kernel 5.15.167.4) to 3.0.3.0 (kernel 6.18.54.1)
Memory Integrity: it was already off
Fix
Uninstalling KB5127648 and rebooting brought back svm and /dev/kvm (crw-rw---- 1 root kvm 10, 232, 12 svm matches in /proc/cpuinfo on the 6-core/12-thread CPU), and sbx works again. Nothing else changed: same WSL 3.0.3.0, same kernel, same .wslconfig.
benhillis commentedon Oct 15, 2026
Thanks for posting (and the duplicates). We have identified the issue with the Windows Update and are working with the servicing team to get a fix out as quickly as possible. If a temporary workaround is found (other than rolling back the KB which has other downsides) I will share it here. Thanks for your patience.
MaKTaiL commentedon Oct 15, 2026
I can confirm the same issue with my AMD CPU. Uninstalling KB5127648 fixed it for me as well.
mrpickles007 commentedon Oct 15, 2026
I can confirm the same issue on my CPU AMD Ryzen 9 8945HS, i sent a feedback via feedback Hub by attaching logs gathered with collect-wsl-logs.ps1 while reproducing the issues.
Fixed by uninstalling the update KB5127648
The feedback is https://aka.ms/AA13sxp7
trieu1162000 commentedon Oct 15, 2026
just ran into the same issue ~
Environment:
10.0.26200.9711(KB5127648 installed 2026-10-13; KB5127647/SSU and KB5127690 also present)6.18.54.1-microsoft-standard-WSL2+, built locally from the Microsoft WSL config withCONFIG_KVM=m/CONFIG_KVM_AMD=mhypervisorlaunchtype Auto; hypervisor boots cleanly (Hyper-V-Hypervisor event ID 1, IOMMU enabled), VBS runningSymptoms are identical to the report:
Hope this info below will help for analysing the root cause:
Assisted-by: opencode : deepseek-flash-4.1
ProcessorCapabilitiesquery fails with 0x8007000D (unknown processor feature bits 59/60) #41918).11 remaining items
tonymet commentedon Oct 19, 2026
I tried downgrading back to 2.9.13 using the .msix package and nested virtualization was still unsupported.
I've tried these workarounds and failed
tonymet commentedon Oct 19, 2026
Tim Malseed (@timusus) can you add instructions on gathering the diagnostics e.g.
HcsGetServicePropertiesi would like to repro them on my env too. I had downgraded to 2.9.13 with no fix.EastCation commentedon Oct 22, 2026
I can reproduce this issue on my AMD system after installing KB5127648.
System information
My
.wslconfigcontains:However, nested virtualization is not exposed to WSL. The
svmCPU flag is missing from/proc/cpuinfo,/dev/kvmdoes not exist, and loadingkvm_amdfails.Relevant output:
Running
wsl --shutdowndoes not resolve the issue. Windows Update currently reports that no updates are available, and KB5127648 cannot be uninstalled through WUSA.Could you please share any workaround or an estimated timeline for a fix? I rely on KVM acceleration for QEMU in WSL2.
Thank you!
mmfallacy commentedon Oct 22, 2026
Maybe uninstalling via WUSA does not work because of Windows Sandbox optional feature being enabled? IIRC, I was able to uninstall it on my machine after disabling it since apparently Windows Sandbox depended on something the security update introduced.
Hope this helps.
NigelMoonwriter commentedon Oct 24, 2026
Additional data point: reproduces on Zen 3+ (Rembrandt), Insider build 26220
10.0.26220.9757— Win11 Pro 25H2, Insider, Feature Experience Pack1000.26100.489.03.0.4.0(stable;wsl --updateand--pre-releaseboth report up to date)6.18.54.1-1113-REMBRANDT-X37Same symptoms, now surfaced by the warning added in #41942:
In-guest:
Host<->guest paravirtualization is healthy, so the fault is isolated to the
ProcessorCapabilitiesquery (VMBus 5.3 with all drivers registered:hv_storvsc, hv_netvsc, hv_balloon, dxgkrnl, hv_sock, hv_pci).
Ruled out:
VirtualMachinePlatform= Enabled,hypervisorlaunchtype= AutoHyperV-KernelInt-VirtualDeviceandHyperV-Guest-KernelIntviadism /enable-feature /all, rebooted -> no changewsl --updateandwsl --update --pre-release-> no newer build availableCorroborates the analysis in #41918 (the
ProcessorCapabilitiesserializer invmcompute.exe/computecore.dllending at bit 55, choking on the newerprocessor-feature bits). Since those bits are synthesized by the hypervisor
rather than being CPU-architecture-specific, this appears to span AMD
generations (Zen 2 in #41918 and the OP, Zen 3+ here) rather than being a
Zen 2-only issue.
nestedVirtualization=truein.wslconfigdoes not help -- the HCS call failsbefore WSL can request the extension. Not blocking me (WSL containers, no KVM
needed), flagging for scope of the
fixinboundlabel.saymondamasio commentedon Oct 24, 2026
same problem
doctor: KVM001, BIN001 and NET005 from the WSL 3.0.x issues (#121)
xrem commentedon Oct 26, 2026
Mentioned prerelease 3.0.4 did not fix the problem.
I've to remove KB5127648 and pause updates to get QEMU/libvirt working again.
PS > Get-HotFix | Select-Object HotFixID, InstalledOn, Description
PS > wsl --version
benhillis commentedon Oct 26, 2026
I believe the fix for this is going out via Windows Update tomorrow.
tonymet commentedon Oct 26, 2026
Ben Hillis (@benhillis) I just want to say great work with this. within a few days, you reopened & took over the ticket, added a clear warning log message to help us know we're affected, and worked on the backend to get the KB shipped for the fix. stellar job supporting customers. a textbook way to handle a regression.
MaKTaiL commentedon Oct 28, 2026
Thanks for the update. I had paused Windows updates to prevent KB5127648 from being installed until the fix was out. I'll resume them now.
feat: Android emulators run in agents on Windows when WSL has /dev/kvm (
tonymet commentedon Oct 28, 2026
does anyone have a more specific diagnostic to check besides KB5127648 ? I'm on insiders, do not have that KB, but I'm still affected by the issue. I'm curious if another workaround would fix
my windows info
facboy commentedon Oct 29, 2026
oh dear...i was on insiders a bit, it's hell to get out. maybe look for an update that dropped 'around' that time?
EDIT: on an unrelated note, anybody confirm that installing KB5127648 now does not cause the bug? i still have it blocked.