CVE-2026-64562: Linux Kernel Privilege Escalation Flaw

CVE-2026-64562 Overview

CVE-2026-64562 is a Linux kernel vulnerability in the KVM nested VMX (nVMX) subsystem. The flaw involves a race condition in shadow Virtual Machine Control Structure (VMCS) handling during nested virtualization teardown. Specifically, free_nested() releases the shadow VMCS while vmcs01 still holds a reference to it. Because the free path runs asynchronously with respect to loaded_vmcs_clear(), a vCPU migration can trigger __loaded_vmcs_clear() to execute VMCLEAR on memory that has already been freed. The upstream fix keeps the VMCS attached until its explicit VMCLEAR completes, then hides the pointer and safely releases the page.

Critical Impact
A local attacker inside a guest with nested virtualization enabled can trigger a use-after-free in host kernel memory, potentially leading to host memory corruption or denial of service.

Affected Products

Linux kernel builds with KVM and nested VMX support on Intel processors
Multiple stable kernel branches referenced in the upstream fix commits
Distributions shipping affected mainline and stable kernels prior to backporting the fix

Discovery Timeline

2026-08-04 - CVE-2026-64562 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-64562

Vulnerability Analysis

The defect resides in KVM's nested VMX handling of the shadow VMCS. In Intel virtualization, a shadow VMCS accelerates nested guest execution by allowing L1 hypervisors to issue VMREAD and VMWRITE without traps. When a nested guest tears down, free_nested() must release this shadow VMCS. The bug occurs because the shadow VMCS pointer remains embedded in vmcs01 after the backing page is freed.

Asynchronously, another CPU running loaded_vmcs_clear() may still reach __loaded_vmcs_clear() after the vCPU migrates. That handler then executes a VMCLEAR instruction against the stale pointer, operating on memory that no longer belongs to KVM. This is a classic use-after-free ordering bug in kernel virtualization state management.

Root Cause

The root cause is an ordering violation between free_nested() and loaded_vmcs_clear(). The shadow VMCS page is released before vmcs01 stops referencing it, and no synchronization guarantees that all pending VMCLEAR operations targeting the shadow VMCS complete before the page is freed. The correct invariant, enforced by the patch, is that the VMCS must remain attached until its explicit VMCLEAR completes, and only then may its pointer be hidden and its page released.

Attack Vector

Exploitation requires local access as a guest running under a KVM host with nested virtualization enabled. A malicious L1 guest can create and destroy nested VMX state while inducing vCPU migration between physical CPUs, widening the race window. Successful exploitation corrupts host kernel memory through a VMCLEAR write to a freed page. The most reliable outcome is a host kernel crash; memory reuse manipulation could extend impact toward privilege escalation from guest to host, though no public exploit has been reported.

See the upstream fixes for technical details: Kernel Git Commit 1dabef6e, Kernel Git Commit 58941947, Kernel Git Commit 622ebfac, Kernel Git Commit 8001d2ce, and Kernel Git Commit af56298e.

Detection Methods for CVE-2026-64562

Indicators of Compromise

Unexpected host kernel oops or panic traces referencing vmx.c, free_nested, loaded_vmcs_clear, or __loaded_vmcs_clear.
KASAN or SLUB reports indicating use-after-free on VMCS-sized allocations under KVM workloads.
Guest VMs with nested virtualization enabled repeatedly creating, destroying, and migrating vCPUs under adversarial patterns.

Detection Strategies

Enable KASAN and KFENCE on test hosts to surface the use-after-free during nested VMX workloads.
Monitor dmesg and journald for KVM-related warnings, GP faults, or VMCLEAR failures on Intel VMX hosts.
Track unpatched kernel versions across the fleet by comparing running kernels against distribution advisories citing the referenced upstream commits.

Monitoring Recommendations

Alert on kernel panic and unexpected reboot events on hypervisor hosts running KVM with nested virtualization.
Baseline nested virtualization use per tenant and investigate anomalous vCPU migration patterns tied to guest teardown activity.
Centralize hypervisor host telemetry for retrospective search across kernel logs and process events.

How to Mitigate CVE-2026-64562

Immediate Actions Required

Apply the upstream Linux kernel fixes referenced in the CVE record to all affected hypervisor hosts.
Where patching is delayed, disable nested virtualization on KVM hosts that do not require it.
Prioritize remediation on multi-tenant hosts where untrusted guests can run their own nested hypervisors.

Patch Information

The fix modifies KVM to keep the shadow VMCS attached until its explicit VMCLEAR completes, then hides the pointer before freeing the page. Backports are available across stable branches via commits 1dabef6e, 58941947, 622ebfac, 8001d2ce, and af56298e. Consume the patched kernel from your distribution vendor rather than applying commits directly in production.

Workarounds

Disable the kvm_intel nested parameter by setting nested=0 until the patched kernel is deployed.
Restrict guest operators from enabling nested virtualization in workloads that do not need it.
On shared infrastructure, isolate guests that require nested VMX onto patched hosts only.

bash

# Disable KVM Intel nested virtualization until patched kernel is deployed
# Verify current state
cat /sys/module/kvm_intel/parameters/nested

# Persist the setting
echo "options kvm_intel nested=0" | sudo tee /etc/modprobe.d/kvm-nested.conf

# Reload the module (ensure no guests are running)
sudo modprobe -r kvm_intel && sudo modprobe kvm_intel

# Confirm nested VMX is disabled
cat /sys/module/kvm_intel/parameters/nested