CVE-2026-64562
Received Received - Intake

KVM: nVMX Shadow VMCS Use-After-Free in Linux Kernel

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Hide shadow VMCS right after VMCLEAR free_nested() frees the shadow VMCS while vmcs01 still points to it. But because it is asynchronous with respect to loaded_vmcs_clear(), the vCPU might migrate before the pointer is cleared and __loaded_vmcs_clear() may then execute VMCLEAR. The VMCS needs to stay attached until its explicit VMCLEAR completes, but then it can be hidden and the page safely freed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-64562
EUVD
EUVD-2026-52603

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the KVM (Kernel-based Virtual Machine) component related to nested virtualization (nVMX). The issue occurs when freeing a shadow VMCS (Virtual Machine Control Structure) while another pointer (vmcs01) still references it. The vCPU might migrate before the pointer is cleared, leading to a delayed VMCLEAR operation. This can cause the VMCS to remain attached incorrectly, potentially causing memory corruption or instability.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM (Kernel-based Virtual Machine) implementation and requires kernel-level inspection. Detection involves checking kernel logs for related errors or verifying the kernel version against patched releases. Commands like 'dmesg | grep -i kvm' or 'uname -r' may help identify affected systems.

Impact Analysis

If exploited, this vulnerability could allow a malicious guest VM to cause a denial of service (DoS) on the host system by triggering a kernel crash or instability. It may also enable privilege escalation if an attacker gains control over the VMCS operations. Systems running virtualized workloads with KVM are primarily at risk.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the issue. If immediate patching is not possible, consider disabling KVM virtualization temporarily until updates are applied. Monitor vendor advisories for specific mitigation steps.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64562. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart