CVE-2026-89932
Description
A flaw was found in the Kernel-based Virtual Machine (KVM) subsystem. This vulnerability occurs when KVM reuses a Virtual Processor ID (VPID) without properly flushing Translation Lookaside Buffer (TLB) entries. A malicious guest virtual machine (VM) could potentially exploit this to access stale TLB entries from a previous VM or virtual CPU, leading to information disclosure or privilege escalation.
Mitigation
Disable nested virtualization on Intel KVM hosts if nested virtual machines are not required.
1. Create or modify the module configuration file to disable the nested feature:
# echo "options kvm_intel nested=0" > /etc/modprobe.d/kvm_intel.conf
2. Apply the configuration by removing and reloading the kvm_intel module:
# modprobe -r kvm_intel
# modprobe kvm_intel
Warning: Reloading the kvm_intel kernel module requires stopping all active virtual machines on the host. If virtual machines cannot be stopped immediately, reboot the host system to apply the configuration.
Caveat: Disabling nested virtualization prevents virtual machines from running their own nested hypervisors (L2 guests).
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | 8.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
