Executive brief
KVM (Kernel Virtual Machine) is a Linux hypervisor that allows systems to run virtual machines. A vulnerability in the nested virtualization (nVMX) subsystem could cause stale TLB (translation lookaside buffer) cache entries from previous virtual machines to be incorrectly reused, potentially allowing one guest VM to access memory belonging to another guest or vCPU. This violates isolation guarantees critical to virtualization security.
Technical details
The vulnerability is a cache coherency issue in KVM's nested virtualization (nVMX) VPID handling. When an L1 hypervisor executes VMXOFF followed by VMXON and then runs an L2 guest, the kernel may reallocate a VPID (Virtual Processor ID) that has stale TLB entries from a previous lifetime—potentially associated with a different vCPU or even a different VM. The root cause is that last_vpid is not reset to 0 when vpid02 is freed on VMXOFF, so nested_vmx_transition_tlb_flush() fails to detect the VPID reuse and does not flush the stale TLB entries. The fix sets last_vpid=0 when allocating vpid02 in enter_vmx_operation(), ensuring TLB invalidation on the first nested VM-Enter. This affects nested virtualization scenarios where L1 hypervisors run. Patches have been published and backported to stable kernel series.
Affected products
- Linux Linux kernel Multiple versions affected; patches available in stable series
Timeline
- 2026-09-16: disclosed: CVE-2026-89932 published
- 2026-06-16: patched: Upstream commit f0772389413dce9657c7d6950abf3edbbd511356 by Yosry Ahmed
- 2026-09-11: patched: Backported to stable kernel series