CVE-2026-89932 (GCVE-0-2026-89932)
Vulnerability from cvelistv5
Published
2026-09-16 10:32
Modified
2026-10-19 08:55
Severity ?
8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Always flush vpid02 on first use Make sure vpid02 is always flushed on first use by setting last_vpid=0 when allocating vpid02. nested_vmx_transition_tlb_flush() will always detect a VPID change on first VM-Enter after VMXON, because VPID=0 in vmcs12 is not allowed if L1 enables VPID. This avoids using stale TLB entries from a previous lifetime of the VPID, that might have been associated with a different vCPU (or a completely different VM). Note that last_vpid is already being initialized as 0 when the vCPU is created, but it is not reset when vpid02 is freed on VMXOFF. Hence, the problem can only occur if L1 does VMXOFF -> VMXON, runs an L2, and KVM happens to reuse a VPID that has TLB entries on the physical CPU.
References
Impacted products
Vendor Product Version
Linux Linux Version: 5c614b3583e7b6dab0c86356fa36c2bcbb8322a0
Version: 5c614b3583e7b6dab0c86356fa36c2bcbb8322a0
Version: 5c614b3583e7b6dab0c86356fa36c2bcbb8322a0
Version: 5c614b3583e7b6dab0c86356fa36c2bcbb8322a0
Version: 5c614b3583e7b6dab0c86356fa36c2bcbb8322a0
Version: 5c614b3583e7b6dab0c86356fa36c2bcbb8322a0
Version: 5c614b3583e7b6dab0c86356fa36c2bcbb8322a0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/vmx/nested.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "26de0d2d9a8d14c03e5ebb25fd68b5bfcd5ac366",
              "status": "affected",
              "version": "5c614b3583e7b6dab0c86356fa36c2bcbb8322a0",
              "versionType": "git"
            },
            {
              "lessThan": "8bc609999ec223089fec8d74c7de27d689606b36",
              "status": "affected",
              "version": "5c614b3583e7b6dab0c86356fa36c2bcbb8322a0",
              "versionType": "git"
            },
            {
              "lessThan": "62604376c313178811375f40a282fc2a46cd2311",
              "status": "affected",
              "version": "5c614b3583e7b6dab0c86356fa36c2bcbb8322a0",
              "versionType": "git"
            },
            {
              "lessThan": "8b98d662ab24f34710a56e03bc9169e4a5508606",
              "status": "affected",
              "version": "5c614b3583e7b6dab0c86356fa36c2bcbb8322a0",
              "versionType": "git"
            },
            {
              "lessThan": "22dfcc22c95e91295119a1c3b469816ce44c4804",
              "status": "affected",
              "version": "5c614b3583e7b6dab0c86356fa36c2bcbb8322a0",
              "versionType": "git"
            },
            {
              "lessThan": "121991d150735f3c0f7401678ce4d35c5b4ac898",
              "status": "affected",
              "version": "5c614b3583e7b6dab0c86356fa36c2bcbb8322a0",
              "versionType": "git"
            },
            {
              "lessThan": "f0772389413dce9657c7d6950abf3edbbd511356",
              "status": "affected",
              "version": "5c614b3583e7b6dab0c86356fa36c2bcbb8322a0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/vmx/nested.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "lessThan": "4.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Always flush vpid02 on first use\n\nMake sure vpid02 is always flushed on first use by setting last_vpid=0\nwhen allocating vpid02.  nested_vmx_transition_tlb_flush() will always\ndetect a VPID change on first VM-Enter after VMXON, because VPID=0 in\nvmcs12 is not allowed if L1 enables VPID.\n\nThis avoids using stale TLB entries from a previous lifetime of the\nVPID, that might have been associated with a different vCPU (or a\ncompletely different VM).\n\nNote that last_vpid is already being initialized as 0 when the vCPU is\ncreated, but it is not reset when vpid02 is freed on VMXOFF. Hence, the\nproblem can only occur if L1 does VMXOFF -\u003e VMXON, runs an L2, and KVM\nhappens to reuse a VPID that has TLB entries on the physical CPU."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reached when an L1 nested-VMX guest executes VMXOFF then VMXON and VMLAUNCH/VMRESUME on the host KVM_RUN path (handle_vmxon/enter_vmx_operation into nested_vmx_transition_tlb_flush); no network, adjacent-radio, or physical path hits nVMX VPID allocation.\nAC:L - The L1 attacker fully controls VMXOFF, VMXON, vmcs12 VPID, and vCPU pinning; allocate_vpid() is a deterministic global bitmap, nested VMX and VPID are default, and skipping last_vpid=0 makes the omitted INVVPID on first VM-Enter after VMXON reliably hit.\nPR:L - Needs /dev/kvm and nested VMX, typically a kvm-group user or cloud tenant running QEMU, not init-namespace root; handle_vmxon() only checks guest CPL=0 and CR4.VMXE, and KVM create/run ioctls have no CAP_SYS_ADMIN gate.\nUI:N - Once the attacker has a nested-capable VM, they trigger the flaw with their own VMXOFF/VMXON and VMLAUNCH; no separate victim action such as attaching a device or mounting a filesystem is required.\nS:C - Skipping the vpid02 INVVPID lets L2 use stale hardware TLB entries from a previous lifetime of that VPID, including another vCPU or a different VM, crossing KVM guest isolation so impact is outside L1\u0027s security authority.\nC:H - Reused vpid02 linear or combined TLB entries can translate L2 loads onto another VM\u0027s or recycled host physical pages, giving a read primitive over co-resident guest memory rather than a bounded pointer leak.\nI:H - The same stale translations apply to stores, so L2 can write through another VM\u0027s cached GPA/HPA mappings, corrupting co-resident guest memory and enabling control-flow hijack in the victim VM or further host compromise if pages were reused.\nA:H - Stale VPID hits produce wrong translations that surface as KVM internal/emulation failures and can oops or panic the host when walks land on recycled or unmapped host pages, denying service to the hypervisor and co-located VMs."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:55:06.898Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/26de0d2d9a8d14c03e5ebb25fd68b5bfcd5ac366"
        },
        {
          "url": "https://git.kernel.org/stable/c/8bc609999ec223089fec8d74c7de27d689606b36"
        },
        {
          "url": "https://git.kernel.org/stable/c/62604376c313178811375f40a282fc2a46cd2311"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b98d662ab24f34710a56e03bc9169e4a5508606"
        },
        {
          "url": "https://git.kernel.org/stable/c/22dfcc22c95e91295119a1c3b469816ce44c4804"
        },
        {
          "url": "https://git.kernel.org/stable/c/121991d150735f3c0f7401678ce4d35c5b4ac898"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0772389413dce9657c7d6950abf3edbbd511356"
        }
      ],
      "title": "KVM: nVMX: Always flush vpid02 on first use",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89932",
    "datePublished": "2026-09-16T10:32:22.886Z",
    "dateReserved": "2026-09-11T19:38:34.776Z",
    "dateUpdated": "2026-10-19T08:55:06.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.