KVM nVMX: vpid02 is not flushed on first use after VMXOFF/VMXON, reusing another VM's TLB entries

Impact

last_vpid is initialized to zero when a vCPU is created but was not reset when vpid02 was freed on VMXOFF. If L1 does VMXOFF then VMXON and runs a new L2, and KVM reuses a VPID that still has TLB entries on the physical CPU, the nested guest can run against translations belonging to a previous lifetime of that VPID - possibly a different vCPU or a different VM entirely. That is cross-VM address-translation reuse on a shared host, the kind of leak a multi-tenant GPU cloud cannot accept. This is a distinct bug from the INVVPID-on-the-wrong-CPU issue also fixed this cycle, with its own fix: set last_vpid=0 when allocating vpid02 so the first nested VM-Enter always detects a VPID change and flushes.

Who can reach it

Local, from an L1 guest with nested virtualization enabled on an x86 KVM host. The guest controls the VMXOFF/VMXON sequence; no host credentials are needed. Hosts that do not expose nested virt are unaffected.

What to do

Update to a kernel carrying the linked stable commits and reboot the hypervisor after evacuating guests. Disabling nested virtualization for tenant VMs is an effective interim mitigation.

References

Related entries

• Linux kernel dma-direct: dma_direct_alloc_pages() treats a CPU address as a struct page pointerCVE-2026-89995 · Linux kernel dma-direct (dma_direct_alloc_from_pool return type)High
• Linux iommu/vt-d: stale context-cache entry on alias teardown lets the IOMMU walk freed PASID tablesCVE-2026-90240 · Linux kernel iommu/vt-d (context-cache invalidation for DMA aliases)High
• Linux iommu/tegra241-cmdqv: multi-stream devices get incomplete vSID mapping, zero-stream devices read out of boundsCVE-2026-90425 · Linux kernel iommu/tegra241-cmdqv (vSID to Stream ID mapping)High
• Linux dw-edma: callbacks fire for terminated transfers, dereferencing freed client stateCVE-2026-93042 · Linux kernel dmaengine dw-edma (terminate-all descriptor handling)High
• QEMU 9pfs: use-after-free race between Tlcreate and Twalk lets a guest escape the shared directory to host filesCVE-2026-93834 · QEMU 9pfs (virtio-9p shared directory, Tlcreate/Twalk race)High
• Linux kernel nvme-fc: error recovery iterates an uninitialized IO tagset when admin connect times outCVE-2026-97409 · Linux kernel nvme-fc (requests cancelled in an uninitialized IO tagset during CONNECTING error recovery)High