GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72287 (GCVE-0-2026-72287)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:42
VLAI
Title
KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checks
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checks Move the off-by-default consistency check for vmcs12.tpr_threshold vs. the virtual APIC vTPR into the "normal" controls checks, as waiting until KVM has loaded some amount of state is unnecessary and actively dangerous. Specifically, failure to unwind vmcs01.GUEST_CR3 to KVM's value when EPT is disabled results in KVM running L1 with an L1-controlled CR3, not with KVM's CR3! Alternatively, KVM could simply reset the MMU to force a reload of vmcs01.GUEST_CR3, but the _only_ reason the check was shoved into a "late" flow was to wait until the vmcs12 pages were retrieved. Rather than build up more crusty code, simply access vTPR using a regular guest memory access (performance isn't a concern). To circumvent the restrictions that led to KVM deferring nested_get_vmcs12_pages(), (a) use a VM-scoped API to read guest memory so that it always hits non-SMM memslots (for RSM), and (b) skip the check (since its off-by-default anyways) when the vCPU doesn't want to run, i.e. when userspace is restoring/stuffing state. If reading guest memory fails, simply skip the consistency check, as KVM's de facto ABI is that VMX instruction accesses to non-existent memory get PCI Bus Error semantics, where reads return 0xFFs. And if vTPR=0xFF, then the vTPR is guaranteed to be greater than or equal to TPR_THRESHOLD.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1100e4910ad207bc00aedc8dfdb228dd1b81f310 , < 7d066368f72e6192af7e21c5817626f6da666991 (git)
Affected: 1100e4910ad207bc00aedc8dfdb228dd1b81f310 , < ebdac7554abb347ca4197be241116842161acd9b (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/vmx/nested.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7d066368f72e6192af7e21c5817626f6da666991",
              "status": "affected",
              "version": "1100e4910ad207bc00aedc8dfdb228dd1b81f310",
              "versionType": "git"
            },
            {
              "lessThan": "ebdac7554abb347ca4197be241116842161acd9b",
              "status": "affected",
              "version": "1100e4910ad207bc00aedc8dfdb228dd1b81f310",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/vmx/nested.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Move vTPR vs. TPR Threshold consistency check into \"normal\" checks\n\nMove the off-by-default consistency check for vmcs12.tpr_threshold vs.\nthe virtual APIC vTPR into the \"normal\" controls checks, as waiting until\nKVM has loaded some amount of state is unnecessary and actively dangerous.\nSpecifically, failure to unwind vmcs01.GUEST_CR3 to KVM\u0027s value when EPT\nis disabled results in KVM running L1 with an L1-controlled CR3, not with\nKVM\u0027s CR3!\n\nAlternatively, KVM could simply reset the MMU to force a reload of\nvmcs01.GUEST_CR3, but the _only_ reason the check was shoved into a \"late\"\nflow was to wait until the vmcs12 pages were retrieved.  Rather than build\nup more crusty code, simply access vTPR using a regular guest memory access\n(performance isn\u0027t a concern).  To circumvent the restrictions that led to\nKVM deferring nested_get_vmcs12_pages(), (a) use a VM-scoped API to read\nguest memory so that it always hits non-SMM memslots (for RSM), and (b)\nskip the check (since its off-by-default anyways) when the vCPU doesn\u0027t\nwant to run, i.e. when userspace is restoring/stuffing state.\n\nIf reading guest memory fails, simply skip the consistency check, as KVM\u0027s\nde facto ABI is that VMX instruction accesses to non-existent memory get\nPCI Bus Error semantics, where reads return 0xFFs.  And if vTPR=0xFF, then\nthe vTPR is guaranteed to be greater than or equal to TPR_THRESHOLD."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached when an L1 nested-hypervisor guest executes VMLAUNCH/VMRESUME, driving KVM nested VM-Enter handling during KVM_RUN; no network, adjacent-radio, or physical-access path reaches this nVMX code.\nAC:H - Exploitation requires host EPT disabled (enable_ept=0) and the off-by-default developer warn_on_missed_cc module parameter; both are non-default host settings the attacking guest cannot enable, even though VMCS12/vAPIC fields are attacker-controlled once present.\nPR:L - The attacker needs ring-0 inside an L1 guest VM with nested VMX available (a typical nested-virt cloud tenant running its own hypervisor); no init-namespace host root or CAP_SYS_ADMIN on the host is required beyond ordinary VM execution.\nUI:N - Once nested virtualization is available, the malicious L1 hypervisor triggers the flaw solely via its own VMX instructions and crafted VMCS12/virtual-APIC state; no separate victim user action is required.\nS:C - Failure to restore vmcs01.GUEST_CR3 after the late VM-Fail leaves KVM running L1 with L1-controlled paging instead of KVM shadow CR3, crossing the guest/hypervisor isolation boundary in the classic KVM nested VMX guest-to-host escape class.\nC:H - Running L1 with its own CR3 under shadow paging (EPT disabled) lets the guest use attacker-chosen page tables to read host physical memory and kernel data outside its memslots, yielding arbitrary host information disclosure.\nI:H - The same CR3 confusion gives L1 arbitrary control over host physical mappings, enabling modification of host kernel structures and potential host code execution rather than a benign, correctly unwound VM-Fail.\nA:H - Beyond VM escape, inconsistent host CR3/paging state can oops or panic the host kernel when KVM resumes L1, denying availability to all co-resident VMs on the hypervisor."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:42:22.571Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7d066368f72e6192af7e21c5817626f6da666991"
        },
        {
          "url": "https://git.kernel.org/stable/c/ebdac7554abb347ca4197be241116842161acd9b"
        }
      ],
      "title": "KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into \"normal\" checks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72287",
    "datePublished": "2026-08-15T05:55:09.624Z",
    "dateReserved": "2026-08-09T03:40:39.917Z",
    "dateUpdated": "2026-08-17T05:42:22.571Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72287",
      "date": "2026-09-05",
      "epss": "0.00141",
      "percentile": "0.03752"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72287\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:00.180\",\"lastModified\":\"2026-08-17T06:18:31.437\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: nVMX: Move vTPR vs. TPR Threshold consistency check into \\\"normal\\\" checks\\n\\nMove the off-by-default consistency check for vmcs12.tpr_threshold vs.\\nthe virtual APIC vTPR into the \\\"normal\\\" controls checks, as waiting until\\nKVM has loaded some amount of state is unnecessary and actively dangerous.\\nSpecifically, failure to unwind vmcs01.GUEST_CR3 to KVM\u0027s value when EPT\\nis disabled results in KVM running L1 with an L1-controlled CR3, not with\\nKVM\u0027s CR3!\\n\\nAlternatively, KVM could simply reset the MMU to force a reload of\\nvmcs01.GUEST_CR3, but the _only_ reason the check was shoved into a \\\"late\\\"\\nflow was to wait until the vmcs12 pages were retrieved.  Rather than build\\nup more crusty code, simply access vTPR using a regular guest memory access\\n(performance isn\u0027t a concern).  To circumvent the restrictions that led to\\nKVM deferring nested_get_vmcs12_pages(), (a) use a VM-scoped API to read\\nguest memory so that it always hits non-SMM memslots (for RSM), and (b)\\nskip the check (since its off-by-default anyways) when the vCPU doesn\u0027t\\nwant to run, i.e. when userspace is restoring/stuffing state.\\n\\nIf reading guest memory fails, simply skip the consistency check, as KVM\u0027s\\nde facto ABI is that VMX instruction accesses to non-existent memory get\\nPCI Bus Error semantics, where reads return 0xFFs.  And if vTPR=0xFF, then\\nthe vTPR is guaranteed to be greater than or equal to TPR_THRESHOLD.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/kvm/vmx/nested.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1100e4910ad207bc00aedc8dfdb228dd1b81f310\",\"lessThan\":\"7d066368f72e6192af7e21c5817626f6da666991\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1100e4910ad207bc00aedc8dfdb228dd1b81f310\",\"lessThan\":\"ebdac7554abb347ca4197be241116842161acd9b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/kvm/vmx/nested.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.1,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7d066368f72e6192af7e21c5817626f6da666991\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ebdac7554abb347ca4197be241116842161acd9b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T14:55:22+00:00",
      "cve": "CVE-2026-72287",
      "id": "CVE-2026-72287",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into \"normal\" checks",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72287.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.