CVE-2026-72287

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checks

Move the off-by-default consistency check for vmcs12.tpr_threshold vs.

the virtual APIC vTPR into the "normal" controls checks, as waiting until

KVM has loaded some amount of state is unnecessary and actively dangerous.

Specifically, failure to unwind vmcs01.GUEST_CR3 to KVM's value when EPT

is disabled results in KVM running L1 with an L1-controlled CR3, not with

KVM's CR3!

Alternatively, KVM could simply reset the MMU to force a reload of

vmcs01.GUEST_CR3, but the _only_ reason the check was shoved into a "late"

flow was to wait until the vmcs12 pages were retrieved. Rather than build

up more crusty code, simply access vTPR using a regular guest memory access

(performance isn't a concern). To circumvent the restrictions that led to

KVM deferring nested_get_vmcs12_pages(), (a) use a VM-scoped API to read

guest memory so that it always h

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References