Linux Kernel KVM CVE-2026-64562

The primary remediation is upgrading to a patched Linux kernel version. Stable-branch patches are available at the following commits on kernel.org: 8001d2ce9d9b (branch ~6.6.x, patch 6.6.148), 589419470030 (patch 6.18.42), 622ebfac01ba (patch 7.1.6), 1dabef6e2065, and af56298e9d86 (patch 6.12.101). The upstream fix for 7.2 is documented as 7.2-rc5. Apply the patch appropriate to your kernel stable branch. If immediate patching is not possible, the most effective compensating control is disabling nested virtualization exposure to untrusted guests by removing the 'nested=1' parameter from the kvm-intel module (modprobe kvm-intel nested=0) - this eliminates the attack surface entirely but prevents L1 guests from running their own hypervisors (e.g., running KVM or Hyper-V inside a VM). Alternatively, restrict access to KVM device nodes so that untrusted low-privileged users cannot instantiate or migrate vCPUs. Monitor kernel.org stable queues and downstream distribution security advisories (Ubuntu USN, Red Hat RHSA, SUSE SLES) for official package updates.