CVE-2026-72287

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) component. A consistency check failure in the nested virtualization (nVMX) feature, specifically when Extended Page Tables (EPT) are disabled, allows a malicious first-level (L1) guest to operate with its own controlled CR3 (Control Register 3). This could lead to the L1 guest gaining unauthorized control over memory management, potentially resulting in privilege escalation or arbitrary code execution on the host system.

This vulnerability is rated as Moderate impact because successful exploitation demands local privileged access inside a first-level virtual machine and depends on an uncommon configuration where nested virtualization runs without Extended Page Tables (EPT). Standard Red Hat deployments operate with hardware-assisted memory virtualization enabled by default, significantly limiting the real-world attack surface across supported hypervisor hosts. Systems that do not expose nested virtualization to untrusted tenants or run modern configurations with EPT active remain unaffected by this state consistency handling issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.