CVE-2026-89930

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) nested virtualization (nVMX) component. KVM fails to perform necessary Translation Lookaside Buffer (TLB) flushes when a nested virtual machine (VM) entry operation fails. This can lead to an outdated TLB state, potentially allowing a guest virtual machine to operate with incorrect memory translations.

A KVM nVMX TLB state bug can occur when a nested VM-Enter fails after KVM has already switched far enough into L2 context and queued a local TLB flush. The failed path did not service the queued flush, while VPID tracking such as last_vpid could already be updated. A later successful nested entry could then run with stale TLB translations and may weaken memory isolation between nested virtualization contexts. For the CVSS the PR:L is selected because a local user or process needs access to KVM and nested VMX execution, but full host administrator privileges are not necessarily required in many deployments. The issue is not network reachable by itself and is triggered through local virtualization control paths rather than packet traffic. Impact is at least limited confidentiality, integrity, and availability risk in nested guest memory handling.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.