« Volver al listado

CVE-2026-89930

Estado: RecibidaCrítica (9.3)—

In the Linux kernel, the following vulnerability has been resolved:

KVM: nVMX: Service local TLB flushes on failed nested VM-Enter

KVM services local TLB flushes on "full" nested VM-Exits (through __nested_vmx_vmexit()), but not if a nested VM-Enter fails (e.g. due to failed VMCS checks in nested_vmx_enter_non_root_mode()).

However, it is possible that KVM had queued TLB flushes that need to be performed, even if the nested VM-Enter was not successful. For example, if VPID is disabled for L2 (via nested_vmx_transition_tlb_flush(), or if via the MSR load lists, as the SDM says:

The SDM is unclear about when the TLB flush should occur, and whether or not a failed VM entry would flush the TLB, so it is safer to always do the TLB flush in this case.

Leer descripción completaMostrar menos

More concretely, KVM also updates the last VPID L1 used for L2 in nested_vmx_transition_tlb_flush() (i.e. last_vpid), even if the VM entry ultimately fails. With the current code, KVM could miss a TLB flush if L1 changes L2's VPID, then does a failed VM entry followed by a successful one, as the failed VM entry would update last_vpid but not actually flush the TLB. Servicing local TLB flushes on failed VM entries makes sure that the TLB is always flushed when last_vpid is updated.

Detalles técnicos trazas, registros y código del informe original
  If any MSR is being loaded in such a way that would architecturally
  require a TLB flush, the TLBs are updated so that, after VM entry, the
  logical processor will not use any translations that were cached before
  the transition.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad local (AV:L/PR:N) en kernel KVM que permite escalada tras fallar VM-Enter anidado; impactos potenciales de DoS y manipulación de memoria de hipervisor.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramExecution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate Software

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-89930",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.3,
          "attackVector": "LOCAL",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.5
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5c614b3583e7b6dab0c86356fa36c2bcbb8322a0",
              "lessThan": "c0c66cd575e31218da6a7d104c6ef80b0830b60c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5c614b3583e7b6dab0c86356fa36c2bcbb8322a0",
              "lessThan": "1025b938dc439b75c720a568a855a13eeb245686",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5c614b3583e7b6dab0c86356fa36c2bcbb8322a0",
              "lessThan": "312cdb6d8940827dea63a7a52fb714a5049f06d1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5c614b3583e7b6dab0c86356fa36c2bcbb8322a0",
              "lessThan": "f74fccdf4f7fb0780cd84944108d35f3d9dc46a7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5c614b3583e7b6dab0c86356fa36c2bcbb8322a0",
              "lessThan": "c43563e7518e65ec6ccaa6a65f84c5af5ca5d379",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5c614b3583e7b6dab0c86356fa36c2bcbb8322a0",
              "lessThan": "62c3ee4c9f0e2efef5157358b3549e50ede96d73",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5c614b3583e7b6dab0c86356fa36c2bcbb8322a0",
              "lessThan": "05a0b701d1089fb57beeb8982f23c3bbafe0fa8b",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "arch/x86/kvm/vmx/nested.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.4",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "arch/x86/kvm/vmx/nested.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-16T11:17:02.290",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/05a0b701d1089fb57beeb8982f23c3bbafe0fa8b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/1025b938dc439b75c720a568a855a13eeb245686",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/312cdb6d8940827dea63a7a52fb714a5049f06d1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/62c3ee4c9f0e2efef5157358b3549e50ede96d73",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c0c66cd575e31218da6a7d104c6ef80b0830b60c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c43563e7518e65ec6ccaa6a65f84c5af5ca5d379",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f74fccdf4f7fb0780cd84944108d35f3d9dc46a7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Service local TLB flushes on failed nested VM-Enter\n\nKVM services local TLB flushes on \"full\" nested VM-Exits (through\n__nested_vmx_vmexit()), but not if a nested VM-Enter fails (e.g. due to\nfailed VMCS checks in nested_vmx_enter_non_root_mode()).\n\nHowever, it is possible that KVM had queued TLB flushes that need to be\nperformed, even if the nested VM-Enter was not successful. For example,\nif VPID is disabled for L2 (via nested_vmx_transition_tlb_flush(), or if\nvia the MSR load lists, as the SDM says:\n\n  If any MSR is being loaded in such a way that would architecturally\n  require a TLB flush, the TLBs are updated so that, after VM entry, the\n  logical processor will not use any translations that were cached before\n  the transition.\n\nThe SDM is unclear about when the TLB flush should occur, and whether or\nnot a failed VM entry would flush the TLB, so it is safer to always\ndo the TLB flush in this case.\n\nMore concretely, KVM also updates the last VPID L1 used for L2 in\nnested_vmx_transition_tlb_flush() (i.e. last_vpid), even if the VM entry\nultimately fails. With the current code, KVM could miss a TLB flush if\nL1 changes L2's VPID, then does a failed VM entry followed by a\nsuccessful one, as the failed VM entry would update last_vpid but not\nactually flush the TLB. Servicing local TLB flushes on failed VM entries\nmakes sure that the TLB is always flushed when last_vpid is updated."
    }
  ],
  "lastModified": "2026-09-16T15:18:18.933",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}