CVE-2026-64562

Awaiting Analysis Awaiting Analysis - Queue

KVM: nVMX Shadow VMCS Use-After-Free in Linux Kernel

Publication date: 2026-08-04

Last updated on: 2026-11-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Hide shadow VMCS right after VMCLEAR free_nested() frees the shadow VMCS while vmcs01 still points to it. But because it is asynchronous with respect to loaded_vmcs_clear(), the vCPU might migrate before the pointer is cleared and __loaded_vmcs_clear() may then execute VMCLEAR. The VMCS needs to stay attached until its explicit VMCLEAR completes, but then it can be hidden and the page safely freed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-11-03

Generated

2026-11-08

AI Q&A

2026-08-04

EPSS Evaluated

2026-11-07

NVD

CVE-2026-64562

EUVD

EUVD-2026-52603

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the KVM (Kernel-based Virtual Machine) component related to nested virtualization (nVMX). The issue occurs when freeing a shadow VMCS (Virtual Machine Control Structure) while another pointer (vmcs01) still references it. The vCPU might migrate before the pointer is cleared, leading to a delayed VMCLEAR operation. This can cause the VMCS to remain attached incorrectly, potentially causing memory corruption or instability.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM (Kernel-based Virtual Machine) implementation and requires kernel-level inspection. Detection involves checking kernel logs for related errors or verifying the kernel version against patched releases. Commands like 'dmesg | grep -i kvm' or 'uname -r' may help identify affected systems.

Impact Analysis

If exploited, this vulnerability could allow a malicious guest VM to cause a denial of service (DoS) on the host system by triggering a kernel crash or instability. It may also enable privilege escalation if an attacker gains control over the VMCS operations. Systems running virtualized workloads with KVM are primarily at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a specific technical issue in the Linux kernel's KVM virtualization module. Compliance impacts would depend on how the vulnerability is exploited in a system handling regulated data.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the issue. If immediate patching is not possible, consider disabling KVM virtualization temporarily until updates are applied. Monitor vendor advisories for specific mitigation steps.

Hi! I’m here to help you understand CVE-2026-64562. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...