Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-89930— KVM: nVMX: Service local TLB flushes on failed nested VM-Enter

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该 Linux 内核漏洞描述的中文翻译： 在 Linux 内核中，已修复以下漏洞： KVM：nVMX：在嵌套 VM-Enter 失败时执行本地 TLB 刷新 KVM 会在“完整”的嵌套 VM-Exit 时处理本地 TLB 刷新（通过 ），但不会在嵌套 VM-Enter 失败时执行该操作（例如由于 中 VMCS 检查失败导致的失败）。 然而，即使嵌套 VM-Enter 未成功，KVM 可能已经排队了需要执行的 TLB 刷新请求。例如： 当 L2 的 VPID 被禁用时（通过 ）； 或者通过 MSR 加载列表。正

CVSS 9.3 · Critical EPSS 0.18% · P8

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux 5c614b3583e7b6dab0c86356fa36c2bcbb8322a0< c0c66cd575e31218da6a7d104c6ef80b0830b60c affected
5c614b3583e7b6dab0c86356fa36c2bcbb8322a0< 1025b938dc439b75c720a568a855a13eeb245686 affected
5c614b3583e7b6dab0c86356fa36c2bcbb8322a0< 312cdb6d8940827dea63a7a52fb714a5049f06d1 affected
5c614b3583e7b6dab0c86356fa36c2bcbb8322a0< f74fccdf4f7fb0780cd84944108d35f3d9dc46a7 affected
5c614b3583e7b6dab0c86356fa36c2bcbb8322a0< c43563e7518e65ec6ccaa6a65f84c5af5ca5d379 affected
5c614b3583e7b6dab0c86356fa36c2bcbb8322a0< 62c3ee4c9f0e2efef5157358b3549e50ede96d73 affected
5c614b3583e7b6dab0c86356fa36c2bcbb8322a0< 05a0b701d1089fb57beeb8982f23c3bbafe0fa8b affected
4.4 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89930

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
KVM: nVMX: Service local TLB flushes on failed nested VM-Enter
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Service local TLB flushes on failed nested VM-Enter KVM services local TLB flushes on "full" nested VM-Exits (through __nested_vmx_vmexit()), but not if a nested VM-Enter fails (e.g. due to failed VMCS checks in nested_vmx_enter_non_root_mode()). However, it is possible that KVM had queued TLB flushes that need to be performed, even if the nested VM-Enter was not successful. For example, if VPID is disabled for L2 (via nested_vmx_transition_tlb_flush(), or if via the MSR load lists, as the SDM says: If any MSR is being loaded in such a way that would architecturally require a TLB flush, the TLBs are updated so that, after VM entry, the logical processor will not use any translations that were cached before the transition. The SDM is unclear about when the TLB flush should occur, and whether or not a failed VM entry would flush the TLB, so it is safer to always do the TLB flush in this case. More concretely, KVM also updates the last VPID L1 used for L2 in nested_vmx_transition_tlb_flush() (i.e. last_vpid), even if the VM entry ultimately fails. With the current code, KVM could miss a TLB flush if L1 changes L2's VPID, then does a failed VM entry followed by a successful one, as the failed VM entry would update last_vpid but not actually flush the TLB. Servicing local TLB flushes on failed VM entries makes sure that the TLB is always flushed when last_vpid is updated.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 5c614b3583e7b6dab0c86356fa36c2bcbb8322a0 ~ c0c66cd575e31218da6a7d104c6ef80b0830b60c -
Linux Linux 4.4 -

II. Public POCs for CVE-2026-89930

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89930

请登录查看更多情报信息。

Other References for CVE-2026-89930 (7)

Same Patch Batch · Linux · 2026-09-16 · 276 CVEs total

CVE-2026-90048 9.8 CRITICAL fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
CVE-2026-90012 9.8 CRITICAL spi: Fix DMA mapping ownership on partial map failure
CVE-2026-89970 9.8 CRITICAL nvmet-auth: Synchronize timeout work during SQ teardown
CVE-2026-89857 9.8 CRITICAL scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
CVE-2026-89969 9.8 CRITICAL nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
CVE-2026-89847 9.8 CRITICAL scsi: qla2xxx: Avoid double completion in async IOCB timeout
CVE-2026-89972 9.8 CRITICAL nvme: add missing SRCU grace period in error path
CVE-2026-89990 9.8 CRITICAL ceph: lock mutex in ceph_mds_check_access()
CVE-2026-90036 9.8 CRITICAL NFSD: Prevent client use-after-free during blocked-lock reaping
CVE-2026-90038 9.8 CRITICAL NFSD: Prevent client use-after-free during export state revocation
CVE-2026-90037 9.8 CRITICAL NFSD: Prevent client use-after-free during close_lru reaping
CVE-2026-89788 9.8 CRITICAL ksmbd: fix tree connection use-after-free in smb2_tree_connect()
CVE-2026-89783 9.8 CRITICAL xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
CVE-2026-90042 9.8 CRITICAL ceph: properly decrypt filenames in vmalloc() buffers
CVE-2026-89778 9.8 CRITICAL isofs: fix out-of-bounds page array access on empty zisofs block
CVE-2026-90049 9.3 CRITICAL net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
CVE-2026-89775 9.3 CRITICAL KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
CVE-2026-89915 9.3 CRITICAL KVM: arm64: Remove VM-wide VNCR mapping counter
CVE-2026-89916 9.3 CRITICAL KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
CVE-2026-89918 9.3 CRITICAL KVM: arm64: Correctly handle end of VA space TLBI invalidation

Showing top 20 of 276 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-89930

No comments yet

Leave a comment