CVE-2026-98720
Received Received - Intake

KVM MSR Bitmap Refresh Flaw in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified Force a refresh of the vmcs02 MSR bitmap during nested VM-Enter if the runtime eVMCS controls (pin, primary, secondary, etc.) are being updated. If L1 isn't intercepting TPR writes, runs L2 with TPR virtualization, and then runs the same L2 with TPR virtualization disabled, KVM will fail to refresh msr_bitmap02 and leave TPR in passthrough mode even though TPR virtualization is disabled. I.e. failure to refresh the bitmap lets L2 (or L1 by proxy) read and write L0's TPR.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98720
EUVD
EUVD-2026-103974

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 502d2bf5f2fd7c05adc2d4f057910bd5d4c4c63e
Linux Linux 502d2bf5f2fd7c05adc2d4f057910bd5d4c4c63e
Linux Linux 502d2bf5f2fd7c05adc2d4f057910bd5d4c4c63e
Linux Linux 502d2bf5f2fd7c05adc2d4f057910bd5d4c4c63e
Linux Linux 5.17

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in the Linux kernel related to KVM (Kernel-based Virtual Machine) and nested virtualization. It occurs when runtime eVMCS controls (like pin, primary, or secondary settings) are modified without forcing a refresh of the MSR bitmap. This can lead to KVM failing to update the TPR (Task Priority Register) virtualization state correctly, potentially allowing a guest VM to read or write the host's TPR even when it shouldn't have access.

Detection Guidance

Detection requires checking if the Linux kernel is vulnerable to CVE-2026-98720. Verify your kernel version and check if it includes the fix for the KVM nVMX MSR bitmap refresh issue. Use commands like 'uname -a' to check the kernel version and 'grep' to inspect KVM-related patches.

Impact Analysis

If exploited, this vulnerability could allow a malicious guest VM to gain unauthorized access to the host system's TPR, potentially leading to privilege escalation or information disclosure. Systems using KVM with nested virtualization enabled are at risk if the host kernel is vulnerable.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this vulnerability. If immediate patching is not possible, disable nested virtualization (nVMX) in KVM as a temporary workaround. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98720. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart