CVE-2026-68081: Linux Kernel Information Disclosure Bug

CVE-2026-68081 Overview

CVE-2026-68081 is a memory leak vulnerability in the Linux kernel's KVM nested VMX (nVMX) subsystem. The flaw exists in the handling of vmcs12 pages when KVM synthesizes a nested VM-Exit due to invalid guest state during emulation of VMLAUNCH or VMRESUME. The invalid guest state path does not use nested_vmx_vmexit() and its open-coded equivalent neglects to release the vmcs12 pages. When L1 retries VMLAUNCH or VMRESUME, pinned pages and mappings accumulate, causing resource exhaustion on the host kernel.

Critical Impact
A malicious or misbehaving L1 guest can repeatedly trigger the invalid guest state path to leak pinned host pages, exhausting host memory and impacting availability of the virtualization host.

Affected Products

Linux kernel versions containing the vulnerable KVM nVMX code path prior to the referenced stable commits
Systems running KVM with Intel VT-x and nested virtualization enabled
Hypervisor hosts exposing nested virtualization to untrusted L1 guests

Discovery Timeline

2026-08-08 - CVE-2026-68081 published to NVD
2026-08-08 - Last updated in NVD database

Technical Details for CVE-2026-68081

Vulnerability Analysis

The vulnerability resides in the KVM nested VMX emulation logic on Intel processors. During emulation of VMLAUNCH or VMRESUME, KVM must validate the guest state described by the vmcs12 structure controlled by L1. When guest state validation fails, KVM synthesizes a nested VM-Exit back to L1 to report the failure.

The standard exit path, nested_vmx_vmexit(), is intentionally restricted to scenarios where L2 is active. The invalid guest state case occurs before L2 becomes active, so KVM uses an open-coded equivalent to synthesize the exit. That open-coded path omits the call that releases the vmcs12 pages previously acquired by vmx_get_nested_state_pages(). Each retry of VMLAUNCH or VMRESUME by L1 causes additional page pins without corresponding releases.

Root Cause

The root cause is an incomplete cleanup sequence in the failure path. vmx_get_nested_state_pages() pins and maps the vmcs12 pages in preparation for VM entry. On the success path and on full nested VM-Exit, these mappings are released. The invalid-guest-state failure path bypasses nested_vmx_vmexit() and never invokes the corresponding put logic, resulting in a leak of pinned pages and mappings [CWE-401].

The !from_vmenter scenario is not affected because vmx_get_nested_state_pages() only acquires the vmcs12 pages when L2 is active, guaranteeing a full VM-Exit before KVM would retry acquiring the pages.

Attack Vector

Exploitation requires the ability to execute VMX instructions from an L1 guest on a KVM host with nested virtualization enabled. A hostile L1 kernel repeatedly issues VMLAUNCH or VMRESUME with a vmcs12 crafted to fail guest-state checks. Each attempt leaks pinned host pages, gradually consuming host memory and degrading or halting host and co-tenant workloads.

The vulnerability is described in prose above. Technical patch content is available in the upstream fixes:

Detection Methods for CVE-2026-68081

Indicators of Compromise

Steadily rising kernel memory usage on KVM hosts running nested guests, with no corresponding growth in guest working sets
Elevated counts of pinned pages attributable to KVM processes without matching VM lifecycle events
Repeated nested VM-Exit events reporting invalid guest state from the same L1 guest

Detection Strategies

Monitor KVM tracepoints such as kvm_nested_vmexit and related nVMX events for high-frequency invalid guest state exits from a single L1
Correlate host memory pressure trends with per-VM guest activity to isolate leaking L1 instances
Audit kernel versions across the hypervisor fleet against the fixed stable commits listed above

Monitoring Recommendations

Track MemAvailable, Slab, and pinned page metrics on hypervisor hosts and alert on sustained downward trends
Enable KVM event logging and forward to a centralized analytics pipeline for cross-host correlation
Baseline nested virtualization exit reason distributions per tenant and alert on anomalous invalid-state exit rates

How to Mitigate CVE-2026-68081

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits listed above
Inventory hypervisor hosts running KVM with nested virtualization enabled and prioritize patching
Restrict nested virtualization exposure to trusted L1 workloads until patches are deployed

Patch Information

The fix ensures that vmcs12 pages are released on the invalid guest state path when KVM synthesizes a nested VM-Exit during emulation of VMLAUNCH or VMRESUME. Distribution kernels should pick up the fix through the stable tree. Refer to the commits 2c87a087c206, 2f2312c422fd, and 7996013b8568 to verify backports in vendor kernels.

Workarounds

Disable nested virtualization on KVM hosts by reloading kvm_intel with nested=0 where the feature is not required
Limit which tenants or workloads may run nested hypervisors through hypervisor policy and libvirt configuration
Implement host memory quotas and OOM policies that isolate leaking guests before they impact co-tenants

bash

# Disable nested virtualization on Intel KVM hosts
sudo modprobe -r kvm_intel
echo "options kvm_intel nested=0" | sudo tee /etc/modprobe.d/kvm-nested.conf
sudo modprobe kvm_intel

# Verify nested is disabled
cat /sys/module/kvm_intel/parameters/nested