CVE-2026-89931: Linux Kernel KVM Privilege Escalation Flaw

CVE-2026-89931 Overview

CVE-2026-89931 affects the Linux kernel's KVM nested VMX (nVMX) subsystem. The flaw involves the KVM_REQ_GET_NESTED_STATE_PAGES request not being reliably cleared when emulating a nested VM-Exit. KVM relies on the request check to clear the flag and avoid double-mapping vmcs12 pages. When KVM is built with CONFIG_KVM_HYPERV=n, this clearing path can be skipped, producing incorrect state after emulated VMLAUNCH or VMRESUME instructions. The upstream fix ensures the request is always checked and cleared during nested VM-Exit emulation.

Critical Impact
Improper clearing of a nested KVM request flag can lead to vmcs12 pages being mapped twice, producing inconsistent nested virtualization state on affected Linux kernel builds.

Affected Products

Linux kernel builds with KVM nested VMX (nVMX) enabled on Intel hosts
Linux kernel configurations with CONFIG_KVM_HYPERV=n
Specific fixed commits: 11722439fb20, 674a3244f07f, ae190f2439ca, bbec4adc2f34

Discovery Timeline

2026-09-16 - CVE-2026-89931 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89931

Vulnerability Analysis

The issue exists in KVM's nested VMX emulation logic. When a guest running under KVM triggers a nested VM-Exit, KVM must reconcile the nested state of the level-1 hypervisor guest, including the vmcs12 structure that describes the nested VM.

KVM uses the KVM_REQ_GET_NESTED_STATE_PAGES request as a deferred signal that nested state pages need to be mapped. The subsystem depends on the request being both checked and cleared during VM-Exit emulation. If KVM bails from VM-Enter without processing the request, and the guest subsequently executes VMLAUNCH or VMRESUME, the flag can persist. This causes the vmcs12 pages to be mapped twice.

When the kernel is built without Hyper-V emulation support (CONFIG_KVM_HYPERV=n), the code paths that previously cleared the request are not compiled in. The fix ensures the check-and-clear behavior runs unconditionally on nested VM-Exit emulation.

Root Cause

The root cause is a conditional compilation gap. Clearing of KVM_REQ_GET_NESTED_STATE_PAGES was tied to Hyper-V-related code paths guarded by CONFIG_KVM_HYPERV. Without those paths, the request flag is not cleared on nested VM-Exit, leading to duplicate mapping of vmcs12 pages on the next VMLAUNCH or VMRESUME.

Attack Vector

The defect is reachable only from within a level-1 guest that itself runs nested virtualization. A guest capable of executing VMLAUNCH or VMRESUME can trigger the erroneous state during nested VM-Exit emulation. Exploitation requires an attacker to already control a nested-capable VM on a vulnerable host kernel. Public exploit code and CISA KEV listing are not reported for this issue at the time of publication.

No verified proof-of-concept code is available. See the upstream kernel commits
listed under External References for the exact patch diff and code paths.

Detection Methods for CVE-2026-89931

Indicators of Compromise

No specific runtime indicators are published for this flaw; abnormal KVM behavior such as unexpected guest hangs, host WARN_ON splats referencing nested.c, or repeated nested VM-Exit errors on Intel VMX hosts can indicate exposure.
Kernel log messages referencing vmcs12 mapping errors or KVM_REQ_GET_NESTED_STATE_PAGES during nested guest activity.

Detection Strategies

Inventory Linux hosts running KVM with nested virtualization enabled and identify builds where CONFIG_KVM_HYPERV=n.
Compare running kernel versions and vendor package builds against the fixed upstream commits (11722439fb20, 674a3244f07f, ae190f2439ca, bbec4adc2f34).
Monitor dmesg and journal output on hypervisors for KVM warnings originating from arch/x86/kvm/vmx/nested.c.

Monitoring Recommendations

Forward hypervisor kernel logs to a centralized logging platform and alert on KVM-related WARN or BUG entries.
Track guest crash and restart rates on nested-virtualization workloads to identify anomalies that may correlate with the flaw.
Review configuration management data for kernel build options on all virtualization hosts.

How to Mitigate CVE-2026-89931

Immediate Actions Required

Apply the upstream kernel patches referenced in the fixed commits or update to a distribution kernel that incorporates them.
Disable nested virtualization on hosts where it is not required by clearing the nested module parameter for kvm_intel.
Restrict which tenants and workloads are permitted to run nested VMs until affected hosts are patched.

Patch Information

The fix is delivered through the Linux kernel stable tree. Refer to the upstream commits: Kernel Git Commit 11722439fb20, Kernel Git Commit 674a3244f07f, Kernel Git Commit ae190f2439ca, and Kernel Git Commit bbec4adc2f34. Rebuild affected kernels or install vendor updates that include these commits, then reboot hypervisor hosts to activate the patched kernel.

Workarounds

Rebuild the kernel with CONFIG_KVM_HYPERV=y where operationally acceptable, since the affected clearing behavior is present in that configuration.
Disable nested VMX by loading kvm_intel with nested=0 until patched kernels are deployed.
Limit guest access to workloads that do not require nested virtualization, reducing exposure of the vulnerable code path.

bash

# Disable nested virtualization on Intel KVM hosts until patched
echo "options kvm_intel nested=0" | sudo tee /etc/modprobe.d/kvm-nested.conf
sudo modprobe -r kvm_intel
sudo modprobe kvm_intel
cat /sys/module/kvm_intel/parameters/nested