CVE-2026-68081
Received Received - Intake

Memory Leak in Linux Kernel KVM

Publication date: 2026-08-08

Last updated on: 2026-08-08

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state Put all vmcs12 pages if KVM synthesizes a nested VM-Exit due to invalid guest while emulating VMLAUNCH or VMRESUME. The invalid guest state path doesn't use nested_vmx_vmexit() as that API is intended to be used if and only if L2 is active, and the open coded equivalent neglects to put the vmcs12 pages. Failure to put the vmcs12 pages leaks any pinned pages (and/or mappings) if L1 retries VMLAUNCH/VMRESUME. Note, the !from_vmenter scenario doesn't suffer the same problem, as vmx_get_nested_state_pages() only gets/pins/maps the vmcs12 pages if L2 is active, i.e. if a "full" VM-Exit is guaranteed before KVM will retry getting vmcs12 pages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-08
Last Modified
2026-08-08
Generated
2026-08-08
AI Q&A
2026-08-08
EPSS Evaluated
N/A
NVD
CVE-2026-68081
EUVD
EUVD-2026-54774

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a failure to properly release vmcs12 pages when nested VM-Enter operations fail due to invalid guest state. During emulation of VMLAUNCH or VMRESUME instructions, if the guest state is invalid, the system synthesizes a nested VM-Exit but does not call the proper cleanup function to release pinned pages. This leads to memory leaks where pages remain allocated.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM (Kernel-based Virtual Machine) implementation and relates to improper handling of nested virtualization states. Detection requires checking kernel logs for errors related to KVM or nested VMX operations. Commands like dmesg | grep -i kvm or journalctl -k | grep -i kvm may reveal issues. Ensure your kernel version is up-to-date and review KVM-related errors in system logs.

Impact Analysis

The impact includes potential memory exhaustion over time due to leaked pinned pages. This could cause system instability, crashes, or degraded performance. Systems running virtual machines with nested virtualization enabled are particularly affected.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the issue. If patches are unavailable, disable nested virtualization in KVM by setting nested=0 in the KVM module parameters or disabling KVM entirely if not required. Monitor kernel security advisories for updates and verify the fix by checking kernel logs for resolved errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68081. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart