EUVD-2026-80532
GHSA-8q77-gpg3-wgrc
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Requires a compromised L1 guest (PR:L, AV:L) and a nondeterministic VPID-reuse/TLB-residency window (AC:H); guest→host isolation break is S:C; stale-TLB impact is DoS-dominant (A:H) with only partial C/I.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
KVM: nVMX: Always flush vpid02 on first use
Make sure vpid02 is always flushed on first use by setting last_vpid=0 when allocating vpid02. nested_vmx_transition_tlb_flush() will always detect a VPID change on first VM-Enter after VMXON, because VPID=0 in vmcs12 is not allowed if L1 enables VPID.
This avoids using stale TLB entries from a previous lifetime of the VPID, that might have been associated with a different vCPU (or a completely different VM).
Note that last_vpid is already being initialized as 0 when the vCPU is created, but it is not reset when vpid02 is freed on VMXOFF. Hence, the problem can only occur if L1 does VMXOFF -> VMXON, runs an L2, and KVM happens to reuse a VPID that has TLB entries on the physical CPU.
AnalysisAI
Stale TLB entries can be reused by an L2 guest in the Linux kernel's KVM nested virtualization (nVMX) implementation on x86 Intel VMX hosts, because vpid02 is not flushed on its first use after a VPID is recycled following an L1 guest's VMXOFF/VMXON cycle. Exploitation requires an attacker who already controls an L1 guest on a host running KVM with nested virtualization enabled (kvm_intel nested=1) where L1 uses VPID for its L2 guests, and success depends on KVM reusing a vpid02 value that still has TLB entries resident on the physical CPU, making the outcome timing- and reuse-dependent rather than deterministic. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the host to run KVM on x86 (Intel VMX) with nested virtualization enabled (kvm_intel nested=1) and an L1 guest that itself enables VPID for its L2 guests. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed and point to a LOWER real-world priority than the vendor's CVSS 8.8 suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available: upgrade to Linux 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, or 7.2.5 (or 7.3-rc1 or later), or to your distribution's kernel build that carries the corresponding stable backports documented at https://git.kernel.org/stable/c/26de0d2d9a8d14c03e5ebb25fd68b5bfcd5ac366, https://git.kernel.org/stable/c/8bc609999ec223089fec8d74c7de27d689606b36, https://git.kernel.org/stable/c/62604376c313178811375f40a282fc2a46cd2311, https://git.kernel.org/stable/c/8b98d662ab24f34710a56e03bc9169e4a5508606, https://git.kernel.org/stable/c/22dfcc22c95e91295119a1c3b469816ce44c4804, https://git.kernel.org/stable/c/121991d150735f3c0f7401678ce4d35c5b4ac898, and https://git.kernel.org/stable/c/f0772389413dce9657c7d6950abf3edbbd511356. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Linux hosts running KVM with kvm_intel nested=1 and determine whether untrusted L1 guests can create L2 guests; if nested virtualization is not required, disable it (kvm_intel nested=0) or restrict it to trusted workloads, and begin applying the vendor-released Linux kernel KVM patch per your distribution's security advisory. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary host file exfiltration from Cloud Hypervisor VMM versions 34.0-50.0. CVSS 10.0. Patch available.
Incorrect handling of queued local TLB flushes in the Linux kernel's KVM nested-VMX (nVMX) implementation can leave stal
Address-rollover bug in the Linux kernel's KVM/arm64 TLB-by-VA invalidation path causes the hypervisor to silently skip
Race conditions in the arm64 KVM path that invalidates VNCR translations can leave a stale stage-1 TLB entry installed f
Missed TLB invalidations in the arm64 KVM nested-virtualization path of the Linux kernel can leave stale translations fo
Range-based TLB invalidation in the arm64 KVM hypervisor of the Linux kernel is computed against the wrong address range
A use-after-free (CWE-416) in the Linux kernel's s390/vfio-ap AP crypto passthrough driver allows a local attacker with
The s390 vfio-ap mediated device (mdev) driver in the Linux kernel fails to actually revoke crypto control-domain access
Stale hardware access to unplugged crypto resources in Linux KVM guests on IBM Z (s390) stems from a logic error in the
Linux kernel's KVM nested-VMX (nVMX) emulation can leave stale L2 guest TLB entries on a physical CPU, because KVM execu
Slab use-after-free in the Linux kernel's KVM x86 MMU lockless rmap aging path affects hosts running Linux 6.15 through
A use-after-free race in the arm64 KVM vGICv3 code path of the Linux kernel (vgic_v3_save_pending_tables) allows a local
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today