Linux Kernel KVM/TDX CVE-2026-72285

The vulnerability resides in the KVM subsystem's Intel Trust Domain Extensions (TDX) implementation (cpe:2.3:a:linux:linux_kernel). TDX is Intel's hardware-enforced VM isolation technology, available on 4th-generation Xeon Scalable and newer platforms. When userspace calls the KVM_TDX_INIT_VM ioctl, tdx_td_init() first reads user_data->cpuid.nent to compute the size of a flexible kvm_tdx_init_vm structure for kernel-side allocation. The entire user structure is then copied into that allocation. Because the copy includes the cpuid.nent field, and userspace can modify that field concurrently (from a separate thread) between the sizing read and the copy, the value in the copied structure may be larger than the allocation was sized for. setup_tdparams_cpuids() subsequently passes init_vm->cpuid.nent as the array bound to kvm_find_cpuid_entry2(), enabling it to iterate beyond the entries actually copied. The root cause is a classic Time-of-Check Time-of-Use (TOCTOU) race on a user-controlled length field - semantically similar to CWE-367, though CWE is listed as N/A in the advisory. The fix requires that the copied cpuid.nent value match the value used for sizing, rejecting KVM_TDX_INIT_VM if they differ.