GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72285 (GCVE-0-2026-72285)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:42
VLAI
Title
KVM: TDX: Reject concurrent change to CPUID entry count
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: TDX: Reject concurrent change to CPUID entry count Reject KVM_TDX_INIT_VM if userspace changes cpuid.nent between the initial read and the subsequent copy of the initialization data. tdx_td_init() first reads user_data->cpuid.nent to size the flexible kvm_tdx_init_vm copy. The copied structure also contains cpuid.nent, and that field can differ from the value used to size the allocation if userspace modifies the input concurrently. setup_tdparams_cpuids() later passes init_vm->cpuid.nent to kvm_find_cpuid_entry2(), which uses it as the array bound for the copied entries. Require the copied count to match the value used to size the allocation so that CPUID parsing cannot access beyond the entries actually copied.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0bd0a4a1428baaf4447e95f0832492d9e3d64961 , < d6b5aba65e99531c97b146622a406c75653819d5 (git)
Affected: 0bd0a4a1428baaf4447e95f0832492d9e3d64961 , < cfbebb55e5127dc162e73fa8956000055a78606c (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/vmx/tdx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d6b5aba65e99531c97b146622a406c75653819d5",
              "status": "affected",
              "version": "0bd0a4a1428baaf4447e95f0832492d9e3d64961",
              "versionType": "git"
            },
            {
              "lessThan": "cfbebb55e5127dc162e73fa8956000055a78606c",
              "status": "affected",
              "version": "0bd0a4a1428baaf4447e95f0832492d9e3d64961",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/vmx/tdx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: TDX: Reject concurrent change to CPUID entry count\n\nReject KVM_TDX_INIT_VM if userspace changes cpuid.nent between the\ninitial read and the subsequent copy of the initialization data.\n\ntdx_td_init() first reads user_data-\u003ecpuid.nent to size the flexible\nkvm_tdx_init_vm copy.  The copied structure also contains cpuid.nent,\nand that field can differ from the value used to size the allocation if\nuserspace modifies the input concurrently.  setup_tdparams_cpuids() later\npasses init_vm-\u003ecpuid.nent to kvm_find_cpuid_entry2(), which uses it as\nthe array bound for the copied entries.\n\nRequire the copied count to match the value used to size the allocation\nso that CPUID parsing cannot access beyond the entries actually copied."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via local KVM ioctls on /dev/kvm (KVM_CREATE_VM with KVM_X86_TDX_VM, then KVM_MEMORY_ENCRYPT_OP/KVM_TDX_INIT_VM); there is no network, guest, or remote packet path into tdx_td_init().\nAC:L - This is a TOCTOU race where the attacker controls both sides by racing get_user(cpuid.nent) against concurrent writes to the same userspace kvm_tdx_init_vm buffer during memdup_user(), making the out-of-bounds CPUID walk reliably triggerable.\nPR:L - Exploitation requires only the ability to open /dev/kvm and issue KVM_TDX_INIT_VM on a TDX VM, privileges routinely held by local virtualization users (kvm group) and hypervisor service accounts on TDX/confidential-compute hosts, not init-namespace root.\nUI:N - No victim interaction is required; a malicious or compromised VMM process drives the entire ioctl sequence and concurrent memory modification itself during TD VM initialization.\nS:U - Both the vulnerable KVM TDX host-kernel code and the impact (kernel heap disclosure/corruption during TD setup) sit within the host kernel security authority; this is not a guest-to-host VM escape or cross-authority sandbox breakout.\nC:H - kvm_find_cpuid_entry2() uses the inflated cpuid.nent as the bound over a smaller memdup_user allocation, performing an out-of-bounds read of adjacent kernel heap memory whose contents are copied into td_params CPUID/EPTP fields (up to hundreds of entries).\nI:H - Out-of-bounds heap data is fed into td_params and passed to tdh_mng_init() for Trust Domain creation, letting an attacker influence TD CPUID and EPTP configuration with attacker-controlled kernel memory and enabling further memory-corruption exploitation.\nA:H - Reading beyond the undersized kmalloc buffer can fault on unmapped slub memory or corrupt adjacent kernel objects during TD initialization, producing kernel oops/panic and denying service to all VMs on the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:42:20.367Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d6b5aba65e99531c97b146622a406c75653819d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfbebb55e5127dc162e73fa8956000055a78606c"
        }
      ],
      "title": "KVM: TDX: Reject concurrent change to CPUID entry count",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72285",
    "datePublished": "2026-08-15T05:55:08.385Z",
    "dateReserved": "2026-08-09T03:40:39.917Z",
    "dateUpdated": "2026-08-17T05:42:20.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72285",
      "date": "2026-09-05",
      "epss": "0.00154",
      "percentile": "0.04839"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72285\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:21:59.700\",\"lastModified\":\"2026-08-17T06:18:31.197\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: TDX: Reject concurrent change to CPUID entry count\\n\\nReject KVM_TDX_INIT_VM if userspace changes cpuid.nent between the\\ninitial read and the subsequent copy of the initialization data.\\n\\ntdx_td_init() first reads user_data-\u003ecpuid.nent to size the flexible\\nkvm_tdx_init_vm copy.  The copied structure also contains cpuid.nent,\\nand that field can differ from the value used to size the allocation if\\nuserspace modifies the input concurrently.  setup_tdparams_cpuids() later\\npasses init_vm-\u003ecpuid.nent to kvm_find_cpuid_entry2(), which uses it as\\nthe array bound for the copied entries.\\n\\nRequire the copied count to match the value used to size the allocation\\nso that CPUID parsing cannot access beyond the entries actually copied.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/kvm/vmx/tdx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0bd0a4a1428baaf4447e95f0832492d9e3d64961\",\"lessThan\":\"d6b5aba65e99531c97b146622a406c75653819d5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0bd0a4a1428baaf4447e95f0832492d9e3d64961\",\"lessThan\":\"cfbebb55e5127dc162e73fa8956000055a78606c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/kvm/vmx/tdx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/cfbebb55e5127dc162e73fa8956000055a78606c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d6b5aba65e99531c97b146622a406c75653819d5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T09:52:29+00:00",
      "cve": "CVE-2026-72285",
      "id": "CVE-2026-72285",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: TDX: Reject concurrent change to CPUID entry count",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72285.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.