{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/vmx/tdx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d6b5aba65e99531c97b146622a406c75653819d5",
              "status": "affected",
              "version": "0bd0a4a1428baaf4447e95f0832492d9e3d64961",
              "versionType": "git"
            },
            {
              "lessThan": "cfbebb55e5127dc162e73fa8956000055a78606c",
              "status": "affected",
              "version": "0bd0a4a1428baaf4447e95f0832492d9e3d64961",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/vmx/tdx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: TDX: Reject concurrent change to CPUID entry count\n\nReject KVM_TDX_INIT_VM if userspace changes cpuid.nent between the\ninitial read and the subsequent copy of the initialization data.\n\ntdx_td_init() first reads user_data-\u003ecpuid.nent to size the flexible\nkvm_tdx_init_vm copy.  The copied structure also contains cpuid.nent,\nand that field can differ from the value used to size the allocation if\nuserspace modifies the input concurrently.  setup_tdparams_cpuids() later\npasses init_vm-\u003ecpuid.nent to kvm_find_cpuid_entry2(), which uses it as\nthe array bound for the copied entries.\n\nRequire the copied count to match the value used to size the allocation\nso that CPUID parsing cannot access beyond the entries actually copied."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via local KVM ioctls on /dev/kvm (KVM_CREATE_VM with KVM_X86_TDX_VM, then KVM_MEMORY_ENCRYPT_OP/KVM_TDX_INIT_VM); there is no network, guest, or remote packet path into tdx_td_init().\nAC:L - This is a TOCTOU race where the attacker controls both sides by racing get_user(cpuid.nent) against concurrent writes to the same userspace kvm_tdx_init_vm buffer during memdup_user(), making the out-of-bounds CPUID walk reliably triggerable.\nPR:L - Exploitation requires only the ability to open /dev/kvm and issue KVM_TDX_INIT_VM on a TDX VM, privileges routinely held by local virtualization users (kvm group) and hypervisor service accounts on TDX/confidential-compute hosts, not init-namespace root.\nUI:N - No victim interaction is required; a malicious or compromised VMM process drives the entire ioctl sequence and concurrent memory modification itself during TD VM initialization.\nS:U - Both the vulnerable KVM TDX host-kernel code and the impact (kernel heap disclosure/corruption during TD setup) sit within the host kernel security authority; this is not a guest-to-host VM escape or cross-authority sandbox breakout.\nC:H - kvm_find_cpuid_entry2() uses the inflated cpuid.nent as the bound over a smaller memdup_user allocation, performing an out-of-bounds read of adjacent kernel heap memory whose contents are copied into td_params CPUID/EPTP fields (up to hundreds of entries).\nI:H - Out-of-bounds heap data is fed into td_params and passed to tdh_mng_init() for Trust Domain creation, letting an attacker influence TD CPUID and EPTP configuration with attacker-controlled kernel memory and enabling further memory-corruption exploitation.\nA:H - Reading beyond the undersized kmalloc buffer can fault on unmapped slub memory or corrupt adjacent kernel objects during TD initialization, producing kernel oops/panic and denying service to all VMs on the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:42:20.367Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d6b5aba65e99531c97b146622a406c75653819d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfbebb55e5127dc162e73fa8956000055a78606c"
        }
      ],
      "title": "KVM: TDX: Reject concurrent change to CPUID entry count",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72285",
    "datePublished": "2026-08-15T05:55:08.385Z",
    "dateReserved": "2026-08-09T03:40:39.917Z",
    "dateUpdated": "2026-08-17T05:42:20.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}