Executive brief
KVM is a virtualization component in the Linux kernel that allows a system to run multiple virtual machines. A flaw in KVM's nested virtualization code can fail to properly flush Translation Lookaside Buffer (TLB) caches when a nested virtual machine fails to start, potentially leaving stale memory address mappings in place. An attacker with control over a virtual machine could exploit this to read or modify memory that should be inaccessible, compromising the confidentiality and integrity of the hypervisor and other virtual machines.
Technical details
This is a TLB (Translation Lookaside Buffer) coherency bug in KVM's nested virtualization (nVMX) implementation on x86. The vulnerability exists in the nested_vmx_enter_non_root_mode() function in arch/x86/kvm/vmx/nested.c. When a nested VM-Enter operation fails (e.g., due to VMCS validation failures), KVM fails to service queued local TLB flush requests that may have been queued during the attempted context switch to L2 (the nested guest). The issue is particularly acute when VPID (Virtual Processor ID) changes occur, as the last_vpid tracking variable is updated even on failed VM entries, but the corresponding TLB flush is omitted. An attacker controlling a guest VM can trigger a failed VM-Enter followed by a successful one with different VPID settings, causing KVM to skip necessary TLB flushes and retain stale cached address translations. The fix adds a call to kvm_service_local_tlb_flush_requests(vcpu) in the failure path to ensure TLB coherency is maintained. The vulnerability affects the Linux kernel KVM subsystem across multiple versions; patches are available in mainline and stable branches.
Affected products
- Linux Linux kernel Affected versions across multiple stable branches; patched upstream
Timeline
- 2026-09-16: disclosed: CVE published on NVD
- 2026-07-24: patched: Patch committed upstream by Sean Christopherson
- 2026-07-22: other: Initial fix authored by Yosry Ahmed