CVE-2026-72285

Received Received - Intake

KVM TDX Rejects Concurrent CPUID Entry Count Changes

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: TDX: Reject concurrent change to CPUID entry count Reject KVM_TDX_INIT_VM if userspace changes cpuid.nent between the initial read and the subsequent copy of the initialization data. tdx_td_init() first reads user_data->cpuid.nent to size the flexible kvm_tdx_init_vm copy. The copied structure also contains cpuid.nent, and that field can differ from the value used to size the allocation if userspace modifies the input concurrently. setup_tdparams_cpuids() later passes init_vm->cpuid.nent to kvm_find_cpuid_entry2(), which uses it as the array bound for the copied entries. Require the copied count to match the value used to size the allocation so that CPUID parsing cannot access beyond the entries actually copied.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72285

EUVD

EUVD-2026-59184

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition in the KVM (Kernel-based Virtual Machine) TDX (Trust Domain Extensions) module. It occurs when userspace modifies the CPUID entry count concurrently between two operations in KVM_TDX_INIT_VM. This can lead to an incorrect allocation size for CPUID data, potentially allowing out-of-bounds access during CPUID parsing.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM TDX module and requires kernel-level inspection. Detection involves checking kernel logs for KVM_TDX_INIT_VM errors or examining kernel code for the described race condition. No direct network detection commands exist. Use 'dmesg | grep -i tdx' or 'journalctl -k | grep -i tdx' to check for related errors.

Impact Analysis

This vulnerability could allow a malicious user with access to a virtual machine to cause a denial of service or potentially execute arbitrary code in the host kernel. It may lead to system instability or unauthorized access if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a low-level kernel memory management issue in KVM's TDX implementation. Compliance risks would only arise if exploitation leads to unauthorized data access or system compromise, which is not described in the provided context.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the issue. If immediate patching is not possible, restrict access to KVM TDX functionality via kernel module parameters or disable the module entirely using 'modprobe -r kvm_tdx'. Monitor vendor advisories for updates.

Hi! I’m here to help you understand CVE-2026-72285. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70