CVE-2026-89929

A flaw was found in the Kernel-based Virtual Machine (KVM) in the Linux kernel. When using nested virtualization, the INVVPID (Invalidate Virtual Processor ID) instruction may be incorrectly emulated on a different physical CPU than where the guest operating system (L2) last ran. This can lead to stale Translation Lookaside Buffer (TLB) entries, potentially allowing an attacker in a guest virtual machine to access sensitive information or escalate privileges.

KVM nested VMX can emulate INVVPID on a different physical CPU than the one where L2 last ran. This can leave stale VPID tagged TLB entries on the original CPU after L1 believes the invalidation completed, causing L2 to run with stale address translations. For the CVSS the PR:L because an attacker needs local ability to run or control a KVM guest with nested VMX rather than only sending network traffic. The issue is not network reachable. Impact is mainly guest isolation or correctness failure through stale translations, with possible limited confidentiality or integrity impact inside the affected VM and possible availability impact if the guest is destabilized. It does not by itself indicate host memory corruption or a host escape primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.