CVE-2026-99176

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) nested virtualization component. When loading nested virtual machine state fails during certain non-standard entry operations, KVM fails to reset the memory management unit (MMU) pointer back to the root context. A local user with access to KVM can trigger this failure, causing the host kernel to dereference an invalid pointer once the nested state is freed. This issue leads to a host kernel crash, resulting in a Denial of Service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.