KVM nVMX: emulated INVVPID can run on the wrong physical CPU, leaving stale L2 TLB entries

Impact

When emulating INVVPID, KVM executed the instruction on whatever physical CPU L1 happened to be on, using vpid02. If L1 migrated between running L2 and issuing the invalidation, the flush landed on a CPU that never ran that L2, and the stale TLB entries on the original CPU were never invalidated - vmx_vcpu_load_vmcs() does not request a flush because vmcs02.cpu is unchanged. A nested guest then executes against address translations the L1 hypervisor believed it had revoked, which is a memory-integrity and confidentiality break inside nested virtualization. This is relevant to GPU clouds that expose nested virt to tenants or run VMs inside VMs for CI and sandboxing. The fix checks that INVVPID runs on the pCPU L2 last ran on and otherwise forces a full VPID flush on the next nested VM-Enter.

Who can reach it

Local, from an L1 guest running nested VMs on an x86 KVM host. Requires nested virtualization to be enabled and exposed; fleets that do not offer nested virt are not exposed.

What to do

Apply the linked stable commits or a patched distribution kernel and reboot the hypervisor, moving guests off first. As an interim measure, disabling nested virtualization for tenant VMs removes the exposure entirely.

References

Related entries

• KVM nVMX: vpid02 is not flushed on first use after VMXOFF/VMXON, reusing another VM's TLB entriesCVE-2026-89932 · Linux kernel KVM nVMX (vpid02 allocation, last_vpid reset)High
• Linux kernel dma-direct: dma_direct_alloc_pages() treats a CPU address as a struct page pointerCVE-2026-89995 · Linux kernel dma-direct (dma_direct_alloc_from_pool return type)High
• Linux kernel mlx5_core representor TC path + net/sched tc extension: The TC_SKB_EXT skb extension is not zeroedCVE-2021-47136 · Linux kernel mlx5_core representor TC path + net/sched tc extensionHigh
• Linux kernel (net/tls): When a BPF socket policy shrinks the plaintext after the ciphertext length was computed, kTLSCVE-2025-38608 · Linux kernel (net/tls)High
• Linux kernel libceph: truncated monitor reply decodes stale bytes from the reused bufferCVE-2026-68433 · Linux kernel libceph (MON_GET_VERSION_REPLY decode bound)High
• sudo: intercept policy checks skipped for execveat, letting allowed users run denied commandsCVE-2026-82474 · sudo (ptrace-based intercept mode, execveat/fexecve path)High