CVE-2026-99176

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry<br /> <br /> Reset the vCPU&amp;#39;s MMU pointer back to the root MMU if loading L2 state fails<br /> in the "not from VM-Entry" case, i.e. when emulating RSM or handling<br /> KVM_SET_NESTED_STATE. Failure to unwind the MMU pointer results in KVM<br /> trying to run L1 with a nested MMU, and is especially problematic if the<br /> vCPU manages to free its nested state before the VM crashes. Constructing<br /> the root for a nested EPT MMU goes through vmcs12, which is dynamically<br /> allocated/freed when nVMX is enabled/disabled. And so if the nested state<br /> is freed with the MMU still pointing at the nested MMU, KVM will hit a NULL<br /> pointer deref when attempting to get L1=&gt;L2 EPTP.<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000078<br /> #PF: supervisor read access in kernel mode<br /> #PF: error_code(0x0000) - not-present page<br /> PGD 114a2d067 P4D 111743067 PUD 11141f067 PMD 0<br /> Oops: Oops: 0000 [#1] SMP<br /> CPU: 20 UID: 1000 PID: 1272 Comm: nested_tdp_faul Not tainted 7.3.0-rc4-8c89f11d1a99b-sink-vm #1914 PREEMPTLAZY<br /> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015<br /> RIP: 0010:nested_ept_get_eptp+0xb/0x10 [kvm_intel]<br /> Call Trace:<br /> <br /> kvm_mmu_load+0xcd/0x870 [kvm]<br /> kvm_arch_vcpu_ioctl_run+0x18f5/0x1f80 [kvm]<br /> kvm_vcpu_ioctl+0x2c7/0x970 [kvm]<br /> __x64_sys_ioctl+0x90/0xd0<br /> do_syscall_64+0x9c/0x4d0<br /> entry_SYSCALL_64_after_hwframe+0x4b/0x53<br /> RIP: 0033:0x47491b<br /> <br /> Modules linked in: kvm_intel kvm irqbypass<br /> CR2: 0000000000000078<br /> ---[ end trace 0000000000000000 ]---<br /> RIP: 0010:nested_ept_get_eptp+0xb/0x10 [kvm_intel]<br /> <br /> [sean: write changelog]