Executive brief
The Linux kernel's KVM hypervisor contains a logic error in its handling of nested virtual machine (VM) exit operations. When KVM exits from a nested VM, it may fail to properly clear an internal request flag under certain configuration conditions, potentially causing the same memory pages to be mapped multiple times. This could lead to memory corruption or VM instability in environments running nested virtualization.
Technical details
The vulnerability exists in KVM's nested VMX exit handler (arch/x86/kvm/vmx/nested.c, function __nested_vmx_vmexit). The KVM_REQ_GET_NESTED_STATE_PAGES request flag is conditionally checked and cleared only when CONFIG_KVM_HYPERV is enabled. However, if KVM bails from VM-Enter without processing this request and then re-executes VMLAUNCH or VMRESUME, the flag may persist, leading to double-mapping of vmcs12 (virtual machine control structure) pages. The fix moves the kvm_check_request() call outside the CONFIG_KVM_HYPERV conditional block to ensure the flag is always cleared during nested VM-Exit, regardless of build configuration. This requires local access to the host kernel and affects only systems using nested virtualization.
Affected products
- Linux Linux kernel Multiple versions; fix backported to stable branches
Timeline
- 2026-09-16: disclosed: CVE published on NVD
- 2026-07-23: patched: Upstream fix committed by Sean Christopherson
- 2026-09-11: patched: Backported to stable kernel tree