Linux kernel KVM nVMX: queued TLB flushes skipped when a nested VM-Enter fails, leaving stale VPID mappings

Impact

KVM services queued local TLB flushes on full nested VM-Exits but not when a nested VM-Enter fails its VMCS checks. Because KVM still records the new VPID for L2 on the failed entry, an L1 hypervisor that changes L2's VPID, performs a failing entry and then a successful one can end up running L2 against TLB entries cached for the previous context. On an x86 GPU host that rents out nested-capable VMs, that is a stale-translation window inside a tenant's nested guest. The fix always performs the flush on failed entry.

Who can reach it

Local, from a guest running its own hypervisor (nested virtualization) on an Intel KVM host. Requires the ability to run a VM with nested VMX exposed; hosts that do not expose nested VMX are unaffected.

What to do

Deploy a stable kernel carrying the linked commits and reboot each host, draining or migrating VMs first. Turning off nested VMX exposure (kvm_intel nested=0) removes the exposure if a reboot window is far off, but that itself requires reloading the module. No fixed release numbers are given in the record.

References

Related entries

• Linux kernel SMC-R/SMC-D (CLC proposal parsing, iparea_offset / ipv6_prefixes_cnt): Third instance of the same class inCVE-2024-49571 · Linux kernel SMC-R/SMC-D (CLC proposal parsing, iparea_offset / ipv6_prefixes_cnt)Critical
• Go x/crypto ssh/agent: destination restrictions silently dropped when adding keys to a remote agentCVE-2026-39832 · golang.org/x/crypto/ssh/agent (constraint extension serialization)Critical
• Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.c: Nvmet_auth_reply()CVE-2026-64319 · Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.cCritical
• Linux kernel - NVMe-oF target discovery controller, drivers/nvme/target/discovery.c: The discovery controller validatedCVE-2026-64320 · Linux kernel - NVMe-oF target discovery controller, drivers/nvme/target/discovery.cCritical
• perf tools: out-of-bounds heap read parsing a crafted perf.data CPU indexCVE-2026-80670 · Linux kernel perf tools (machine__resolve() CPU index from perf.data samples)Critical
• Linux NFSD: NFSv2 SETATTR reaches notify_change without a mount write referenceCVE-2026-89697 · Linux kernel NFSD (nfsd_proc_setattr, NFSv2 BOTH_TIME_SET path)Critical