CVE-2026-89932

A flaw was found in the Kernel-based Virtual Machine (KVM) subsystem. This vulnerability occurs when KVM reuses a Virtual Processor ID (VPID) without properly flushing Translation Lookaside Buffer (TLB) entries. A malicious guest virtual machine (VM) could potentially exploit this to access stale TLB entries from a previous VM or virtual CPU, leading to information disclosure or privilege escalation.

This vulnerability is rated as an Important impact because the failure to invalidate stale hardware translation cache entries during nested VMX transitions can allow an L1 or L2 guest to access memory mappings belonging to another virtual context. Although this flaw allows potential cross-VM data exposure or privilege elevation, exploitation is restricted to systems where nested Intel virtualization is explicitly utilized. Additionally, successful triggering depends on specific hypervisor state transitions where nested VMX is disabled and re-enabled, and the host reallocates an un-flushed processor identifier. Standard virtualized environments that do not configure or expose nested hardware virtualization are unaffected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable nested virtualization on Intel KVM hosts if nested virtual machines are not required.

1. Create or modify the module configuration file to disable the nested feature:

echo "options kvm_intel nested=0" > /etc/modprobe.d/kvm_intel.conf

2. Apply the configuration by removing and reloading the kvm_intel module:

modprobe -r kvm_intel

modprobe kvm_intel

Warning: Reloading the kvm_intel kernel module requires stopping all active virtual machines on the host. If virtual machines cannot be stopped immediately, reboot the host system to apply the configuration.

Caveat: Disabling nested virtualization prevents virtual machines from running their own nested hypervisors (L2 guests).