CVE-2026-72287
Received Received - Intake

KVM: nVMX vTPR Threshold Check Bypass

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checks Move the off-by-default consistency check for vmcs12.tpr_threshold vs. the virtual APIC vTPR into the "normal" controls checks, as waiting until KVM has loaded some amount of state is unnecessary and actively dangerous. Specifically, failure to unwind vmcs01.GUEST_CR3 to KVM's value when EPT is disabled results in KVM running L1 with an L1-controlled CR3, not with KVM's CR3! Alternatively, KVM could simply reset the MMU to force a reload of vmcs01.GUEST_CR3, but the _only_ reason the check was shoved into a "late" flow was to wait until the vmcs12 pages were retrieved. Rather than build up more crusty code, simply access vTPR using a regular guest memory access (performance isn't a concern). To circumvent the restrictions that led to KVM deferring nested_get_vmcs12_pages(), (a) use a VM-scoped API to read guest memory so that it always hits non-SMM memslots (for RSM), and (b) skip the check (since its off-by-default anyways) when the vCPU doesn't want to run, i.e. when userspace is restoring/stuffing state. If reading guest memory fails, simply skip the consistency check, as KVM's de facto ABI is that VMX instruction accesses to non-existent memory get PCI Bus Error semantics, where reads return 0xFFs. And if vTPR=0xFF, then the vTPR is guaranteed to be greater than or equal to TPR_THRESHOLD.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72287
EUVD
EUVD-2026-59186

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the KVM (Kernel-based Virtual Machine) nested virtualization (nVMX) implementation. The issue occurs when handling the vTPR (virtual Task Priority Register) and TPR (Task Priority Register) threshold consistency check. The check was moved to an earlier stage to avoid complications, but this change could lead to KVM running with an incorrect CR3 register value when EPT (Extended Page Tables) is disabled. This could allow a guest OS to control the host's CR3 register, potentially causing instability or security issues.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM (Kernel-based Virtual Machine) implementation and requires kernel-level inspection. Detection involves checking the kernel version and KVM module behavior. Commands like 'uname -a' to check the kernel version and 'lsmod | grep kvm' to verify KVM module status may help. However, specific detection commands for this CVE are not provided in the context.

Impact Analysis

If exploited, this vulnerability could allow a malicious guest OS to manipulate the host system's memory management, leading to crashes, privilege escalation, or unauthorized access. Systems running virtualized environments with KVM and nested virtualization enabled may be at risk if the flaw is not patched.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that resolves this issue. Check your distribution's security advisories for kernel updates. If using a virtualization environment with KVM, ensure the host kernel is updated. No specific commands are provided in the context for mitigation steps.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72287. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart