CVE-2026-64562
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
KVM: nVMX: Hide shadow VMCS right after VMCLEAR
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Hide shadow VMCS right after VMCLEAR free_nested() frees the shadow VMCS while vmcs01 still points to it. But because it is asynchronous with respect to loaded_vmcs_clear(), the vCPU might migrate before the pointer is cleared and __loaded_vmcs_clear() may then execute VMCLEAR. The VMCS needs to stay attached until its explicit VMCLEAR completes, but then it can be hidden and the page safely freed.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 | affected | git | b82c3144d8264265448292ca406f60bafeba3b6f | Unavailable | None listed |
| 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 | affected | git | 4f50e6aec16f69627dbad5704d1e90a255d766a7 | Unavailable | None listed |
| 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 | affected | git | dc3eecfa219ebc9d01eaf7d1abd1441efe884dab | Unavailable | None listed |
| 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 | affected | git | af56298e9d86e6098cd1d2e155cb2949b7c45412 | Unavailable | None listed |
| 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 | affected | git | 589419470030a89f16cf19300658b6dc644ca946 | Unavailable | None listed |
| 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 | affected | git | 8001d2ce9d9bd09118ce523aef595aa094573ae3 | Unavailable | None listed |
| 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 | affected | git | 1dabef6e206568bf9d9ade74f6e56a48ea35695d | Unavailable | None listed |
| 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 | affected | git | 622ebfac01ba4f9c0060cebd41257fe46fc4a0b3 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 4.9 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 4.9 | Unavailable | None listed |
| 5.10.265 | unaffected | semver | Unavailable | 5.10.* | None listed |
| 5.15.216 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.183 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.148 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.101 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.42 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 7.1.6 | unaffected | semver | Unavailable | 7.1.* | None listed |
| 7.2 | unaffected | original_commit_for_fix | Unavailable | * | None listed |