CVE-2026-64562

KVM: nVMX: Hide shadow VMCS right after VMCLEAR

State: Published
Severity: 8.8 High
Published: Aug 4, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: nVMX: Hide shadow VMCS right after VMCLEAR

free_nested() frees the shadow VMCS while vmcs01 still points to it. But because it is asynchronous with respect to loaded_vmcs_clear(), the vCPU might migrate before the pointer is cleared and __loaded_vmcs_clear() may then execute VMCLEAR.

The VMCS needs to stay attached until its explicit VMCLEAR completes, but then it can be hidden and the page safely freed.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	Linux

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 to before b82c3144d8264265448292ca406f60bafeba3b6fAffected 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 to before 4f50e6aec16f69627dbad5704d1e90a255d766a7Affected 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 to before dc3eecfa219ebc9d01eaf7d1abd1441efe884dabAffected 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 to before af56298e9d86e6098cd1d2e155cb2949b7c45412Affected 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 to before 589419470030a89f16cf19300658b6dc644ca946Affected 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 to before 8001d2ce9d9bd09118ce523aef595aa094573ae3Affected 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 to before 1dabef6e206568bf9d9ade74f6e56a48ea35695dAffected 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 to before 622ebfac01ba4f9c0060cebd41257fe46fc4a0b3Affected
LinuxLinux	4.9Affected before 4.9Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 to before b82c3144d8264265448292ca406f60bafeba3b6fAffected
355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 to before 4f50e6aec16f69627dbad5704d1e90a255d766a7Affected
355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 to before dc3eecfa219ebc9d01eaf7d1abd1441efe884dabAffected
355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 to before af56298e9d86e6098cd1d2e155cb2949b7c45412Affected
355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 to before 589419470030a89f16cf19300658b6dc644ca946Affected
355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 to before 8001d2ce9d9bd09118ce523aef595aa094573ae3Affected
355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 to before 1dabef6e206568bf9d9ade74f6e56a48ea35695dAffected
355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 to before 622ebfac01ba4f9c0060cebd41257fe46fc4a0b3Affected

LinuxLinux

4.9Affected
before 4.9Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.