Executive brief
The Linux kernel's KVM hypervisor has a flaw in how it handles TLB (translation lookaside buffer) invalidation when managing nested virtual machines. When a guest running nested virtualization migrates between physical CPUs, the TLB entries may not be properly flushed, potentially allowing a nested virtual machine to access memory that should have been invalidated. This could lead to information disclosure or incorrect memory isolation between virtual machines.
Technical details
The vulnerability exists in KVM's nested virtualization INVVPID (Invalidate TLB Entries Based on VPID) instruction emulation in arch/x86/kvm/vmx/nested.c. When a Level 1 (L1) guest running a Level 2 (L2) nested guest executes INVVPID, KVM may execute the instruction on a different physical CPU than where L2 is currently running, causing TLB entries on the correct CPU to never be invalidated. The root cause is a race condition: if L2 runs on CPU #1, L1 migrates to CPU #2 and executes INVVPID (which runs on CPU #2), and then L1 migrates back to CPU #1 to run L2, the TLB on CPU #1 remains stale. The fix checks whether the INVVPID is being executed on the same physical CPU where vmcs02 last ran; if not, it invalidates the nested VPID tracking (last_vpid=0) to defer the flush to the next nested VM-Enter on the correct CPU. No user interaction or authentication is required; local privilege is needed to create and manage nested virtual machines.
Affected products
- Linux Linux kernel Multiple versions before fix commit 6d00e67326d831e6e610933a3800712f4ffe6ec1
Timeline
- 2026-09-16: disclosed: CVE-2026-89929 published
- 2026-06-16: patched: Upstream fix commit 6d00e67326d831e6e610933a3800712f4ffe6ec1 authored
- 2026-07-08: patched: Fix merged to mainline
- 2026-09-11: patched: Fix backported to stable kernels