CVE-2026-72285

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) TDX (Trust Domain Extensions) module. A local attacker, by concurrently modifying the CPUID entry count during the initialization of a virtual machine, could cause the CPUID parsing to access memory beyond the intended boundaries. This out-of-bounds access could potentially lead to a denial of service or other undefined behavior within the virtualized environment.

A moderate-impact out-of-bounds read flaw was found in the Linux kernel's KVM TDX (Trust Domain Extensions) module. When userspace invokes the KVM_TDX_INIT_VM ioctl, tdx_td_init() reads cpuid.nent to size the flexible kvm_tdx_init_vm structure copy. A local attacker with privileges to create and initialize TDX virtual machines can concurrently modify cpuid.nent between the initial read and the subsequent copy, so the count embedded in the copied structure differs from the value used to size the allocation. setup_tdparams_cpuids() later passes that copied count to kvm_find_cpuid_entry2(), which uses it as the array bound for the copied entries, allowing CPUID parsing to access memory beyond the entries actually copied. This out-of-bounds access can cause a denial of service or other undefined behavior in the virtualized environment.

The vulnerable code is not present in Red Hat Enterprise Linux 6, 7, 8, and 9, nor in the RHEL 10.0.z and 10.2.z update streams, so those products are not affected. The kernel in Red Hat Enterprise Linux 10.3 and in Red Hat In-Vehicle OS 2.0 and 2.1 is affected; the fix for these streams is currently deferred and will be addressed in a future update. Until a fix is available, the residual risk is that a local user who already has privileges to create and initialize TDX virtual machines could trigger the out-of-bounds read, primarily causing a denial of service of the host.

Red Hat rates this flaw as Moderate severity (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access with privileges to manage KVM virtual machines and the primary impact is to availability. This differs from the upstream CVE.org rating of Important (CVSS 3.1 score 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), which assumes high confidentiality and integrity impact, whereas Red Hat's assessment of this out-of-bounds read in CPUID parsing finds the impact limited to availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.