Bug 2510894 (CVE-2026-64562)

Summary:	CVE-2026-64562 kernel: KVM: nVMX: Hide shadow VMCS right after VMCLEAR
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) nested virtualization (nVMX) feature. This vulnerability occurs because the shadow Virtual Machine Control Structure (VMCS) is freed prematurely while still being referenced. Due to asynchronous operations, a virtual CPU (vCPU) might attempt to execute a VMCLEAR instruction on the freed memory page. This timing issue could lead to system instability or a denial of service for the host system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-04 07:02:19 UTC

In the Linux kernel, the following vulnerability has been resolved:

KVM: nVMX: Hide shadow VMCS right after VMCLEAR

free_nested() frees the shadow VMCS while vmcs01 still points to it. But
because it is asynchronous with respect to loaded_vmcs_clear(), the vCPU
might migrate before the pointer is cleared and __loaded_vmcs_clear()
may then execute VMCLEAR.

The VMCS needs to stay attached until its explicit VMCLEAR completes, but
then it can be hidden and the page safely freed.

Comment 1 Mauro Matteo Cascella 2026-08-04 09:11:06 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026080404-CVE-2026-64562-8875@gregkh/T