CVE-2026-68093

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine). When a virtual CPU (vCPU) is scheduled out and its physical CPU (pCPU) undergoes a hotplug cycle (offline and then online), the vCPU might resume with an Address Space Identifier (ASID) that has been reassigned to another vCPU from a different virtual machine. This ASID collision causes both vCPUs to share Translation Lookaside Buffer (TLB) entries and use outdated translations. This can lead to KVM internal errors, NPT page faults, and ultimately a denial of service for the affected virtual machines.

KVM SVM can reuse an ASID generation after a CPU online-offline-online hotplug cycle. A vCPU that was scheduled out before the hotplug can later resume on the same pCPU with an ASID that has already been assigned to a vCPU from another VM, causing stale NPT TLB translations to be used across VM boundaries. The directly observed failure mode is a KVM internal error and denial of service, but the stale translation condition is an isolation sensitive primitive and may allow confidentiality or integrity impact between guests in a worst case review. For the CVSS the PR:L is used for the paranoid score because delegated virtualization services or reduced capability VM management roles may control VM placement and CPU hotplug workflows without being full host root. The issue is not directly network reachable and requires local host virtualization control rather than packet traffic. Impact should be reviewed as more than a simple crash because ASID collision affects address translation isolation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.