Executive brief
A vulnerability was identified in the Linux kernel's virtualization component (KVM) specifically affecting systems running nested virtual machines on x86 processors. The issue involves an incorrect check during memory management tasks, which could lead to system instability or unexpected behavior when a virtual machine attempts to clear its memory cache. This has been resolved in recent kernel updates to ensure memory addresses are handled correctly.
Technical details
A vulnerability in `arch/x86/kvm/hyperv.c` within the Linux kernel's KVM subsystem stemmed from an incorrect check using `is_guest_mode(vcpu)` in `kvm_hv_flush_tlb()`. The function attempted to call `translate_nested_gpa()` whenever an L2 guest was running, but this translation is only valid if nested Extended Page Tables (EPT) or Nested Page Tables (NPT) are enabled. If an L2 guest runs without these features, the incorrect call could lead to invalid memory access or state. The fix replaces the check with `mmu_is_nested(vcpu)` to ensure the translation is only attempted when the appropriate nested paging features are active.
Affected products
- Linux Linux Kernel Introduced in aee738236dca (2022-11-18)
Timeline
- 2022-11-18: other: Vulnerability introduced in commit aee738236dca
- 2026-04-27: other: Fix authored by Paolo Bonzini
- 2026-05-14: patched: Fix committed to stable branches
- 2026-05-28: disclosed: CVE published
References
- https://git.kernel.org/stable/c/45fc766bc756ff1d66f8ca026a9c4f7f764adfae
- https://git.kernel.org/stable/c/464af6fc2b1dcc74005b7f58ee3812b17777efee
- https://git.kernel.org/stable/c/4c7f8436b19a2a3acc0cb6b6e3becd6796ae5c57
- https://git.kernel.org/stable/c/971f17f5d91045404e3914029ea57c3da90179a4
- https://git.kernel.org/stable/c/d6f4e217d663ede5becc2fd6cb612c749677387b