KVM nVMX: vpid02 is not flushed on first use after VMXOFF/VMXON, reusing another VM's TLB entries

Impact

last_vpid is initialized to zero when a vCPU is created but was not reset when vpid02 was freed on VMXOFF. If L1 does VMXOFF then VMXON and runs a new L2, and KVM reuses a VPID that still has TLB entries on the physical CPU, the nested guest can run against translations belonging to a previous lifetime of that VPID - possibly a different vCPU or a different VM entirely. That is cross-VM address-translation reuse on a shared host, the kind of leak a multi-tenant GPU cloud cannot accept. This is a distinct bug from the INVVPID-on-the-wrong-CPU issue also fixed this cycle, with its own fix: set last_vpid=0 when allocating vpid02 so the first nested VM-Enter always detects a VPID change and flushes.

Who can reach it

Local, from an L1 guest with nested virtualization enabled on an x86 KVM host. The guest controls the VMXOFF/VMXON sequence; no host credentials are needed. Hosts that do not expose nested virt are unaffected.

What to do

Update to a kernel carrying the linked stable commits and reboot the hypervisor after evacuating guests. Disabling nested virtualization for tenant VMs is an effective interim mitigation.

References

Related entries

• Linux kernel dma-direct: dma_direct_alloc_pages() treats a CPU address as a struct page pointerCVE-2026-89995 · Linux kernel dma-direct (dma_direct_alloc_from_pool return type)High
• Linux kernel mlx5_core representor TC path + net/sched tc extension: The TC_SKB_EXT skb extension is not zeroedCVE-2021-47136 · Linux kernel mlx5_core representor TC path + net/sched tc extensionHigh
• Linux kernel (net/tls): When a BPF socket policy shrinks the plaintext after the ciphertext length was computed, kTLSCVE-2025-38608 · Linux kernel (net/tls)High
• Linux kernel libceph: truncated monitor reply decodes stale bytes from the reused bufferCVE-2026-68433 · Linux kernel libceph (MON_GET_VERSION_REPLY decode bound)High
• sudo: intercept policy checks skipped for execveat, letting allowed users run denied commandsCVE-2026-82474 · sudo (ptrace-based intercept mode, execveat/fexecve path)High
• Linux kernel (arch/x86/kvm/svm): Hardware ignores the low five bits of CR3 when loading PDPTEs, but KVM's nested SVMCVE-2024-50115 · Linux kernel (arch/x86/kvm/svm)High