CVE-2026-64562

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) nested virtualization (nVMX) feature. This vulnerability occurs because the shadow Virtual Machine Control Structure (VMCS) is freed prematurely while still being referenced. Due to asynchronous operations, a virtual CPU (vCPU) might attempt to execute a VMCLEAR instruction on the freed memory page. This timing issue could lead to system instability or a denial of service for the host system.

This vulnerability is assessed as Important because an attacker within a nested virtual machine could trigger memory corruption leading to a host crash, crossing the isolation boundary between guest and host. The defect resides in KVM handling of Intel nested virtualization during vCPU migration, where VMCS cleanup operations can race asynchronously. Exposure is limited to environments where nested VMX is explicitly enabled, which is not active by default across standard virtualization deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, disable nested virtualization (nVMX) if it is not required. For Intel processors, add options kvm_intel nested=0 to a new configuration file like /etc/modprobe.d/disable-nested-kvm.conf. For AMD processors, use options kvm_amd nested=0. A system reboot or reloading the kvm_intel or kvm_amd kernel module is required for the change to take effect. Disabling nested virtualization may impact virtual machine functionality that relies on this feature.