Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-89932— KVM: nVMX: Always flush vpid02 on first use

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已修复以下漏洞： KVM: nVMX: 首次使用 vpid02 时始终执行刷新操作 在分配 vpid02 时设置 ，以确保在首次使用时 vpid02 始终被刷新。 函数在 VMXON 之后的首次 VM-Enter 时，若 L1 启用了 VPID，则 VPID=0 在 vmcs12 中是不允许的，因此该函数将始终检测到 VPID 的变化。 这样可以避免重用来自 vPID 之前生命周期的陈旧 TLB 条目，这些条目可能关联了不同的 vCPU（或完全不同的虚拟机）。 需要注意的是，虽然 在 vCP

CVSS 8.8 · High EPSS 0.18% · P7

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux 5c614b3583e7b6dab0c86356fa36c2bcbb8322a0< 26de0d2d9a8d14c03e5ebb25fd68b5bfcd5ac366 affected
5c614b3583e7b6dab0c86356fa36c2bcbb8322a0< 8bc609999ec223089fec8d74c7de27d689606b36 affected
5c614b3583e7b6dab0c86356fa36c2bcbb8322a0< 62604376c313178811375f40a282fc2a46cd2311 affected
5c614b3583e7b6dab0c86356fa36c2bcbb8322a0< 8b98d662ab24f34710a56e03bc9169e4a5508606 affected
5c614b3583e7b6dab0c86356fa36c2bcbb8322a0< 22dfcc22c95e91295119a1c3b469816ce44c4804 affected
5c614b3583e7b6dab0c86356fa36c2bcbb8322a0< 121991d150735f3c0f7401678ce4d35c5b4ac898 affected
5c614b3583e7b6dab0c86356fa36c2bcbb8322a0< f0772389413dce9657c7d6950abf3edbbd511356 affected
4.4 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89932

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
KVM: nVMX: Always flush vpid02 on first use
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Always flush vpid02 on first use Make sure vpid02 is always flushed on first use by setting last_vpid=0 when allocating vpid02. nested_vmx_transition_tlb_flush() will always detect a VPID change on first VM-Enter after VMXON, because VPID=0 in vmcs12 is not allowed if L1 enables VPID. This avoids using stale TLB entries from a previous lifetime of the VPID, that might have been associated with a different vCPU (or a completely different VM). Note that last_vpid is already being initialized as 0 when the vCPU is created, but it is not reset when vpid02 is freed on VMXOFF. Hence, the problem can only occur if L1 does VMXOFF -> VMXON, runs an L2, and KVM happens to reuse a VPID that has TLB entries on the physical CPU.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 5c614b3583e7b6dab0c86356fa36c2bcbb8322a0 ~ 26de0d2d9a8d14c03e5ebb25fd68b5bfcd5ac366 -
Linux Linux 4.4 -

II. Public POCs for CVE-2026-89932

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89932

请登录查看更多情报信息。

Other References for CVE-2026-89932 (7)

Same Patch Batch · Linux · 2026-09-16 · 276 CVEs total

CVE-2026-90048 9.8 CRITICAL fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
CVE-2026-90012 9.8 CRITICAL spi: Fix DMA mapping ownership on partial map failure
CVE-2026-89970 9.8 CRITICAL nvmet-auth: Synchronize timeout work during SQ teardown
CVE-2026-89857 9.8 CRITICAL scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
CVE-2026-89969 9.8 CRITICAL nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
CVE-2026-89847 9.8 CRITICAL scsi: qla2xxx: Avoid double completion in async IOCB timeout
CVE-2026-89972 9.8 CRITICAL nvme: add missing SRCU grace period in error path
CVE-2026-89990 9.8 CRITICAL ceph: lock mutex in ceph_mds_check_access()
CVE-2026-90036 9.8 CRITICAL NFSD: Prevent client use-after-free during blocked-lock reaping
CVE-2026-90038 9.8 CRITICAL NFSD: Prevent client use-after-free during export state revocation
CVE-2026-90037 9.8 CRITICAL NFSD: Prevent client use-after-free during close_lru reaping
CVE-2026-89788 9.8 CRITICAL ksmbd: fix tree connection use-after-free in smb2_tree_connect()
CVE-2026-89783 9.8 CRITICAL xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
CVE-2026-90042 9.8 CRITICAL ceph: properly decrypt filenames in vmalloc() buffers
CVE-2026-89778 9.8 CRITICAL isofs: fix out-of-bounds page array access on empty zisofs block
CVE-2026-89914 9.3 CRITICAL KVM: arm64: Sign-extend VA for range-based TLBI invalidation
CVE-2026-90049 9.3 CRITICAL net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
CVE-2026-89775 9.3 CRITICAL KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
CVE-2026-89916 9.3 CRITICAL KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
CVE-2026-89930 9.3 CRITICAL KVM: nVMX: Service local TLB flushes on failed nested VM-Enter

Showing top 20 of 276 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-89932

No comments yet

Leave a comment