CVE-2026-68081

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state<br /> <br /> Put all vmcs12 pages if KVM synthesizes a nested VM-Exit due to invalid<br /> guest while emulating VMLAUNCH or VMRESUME. The invalid guest state path<br /> doesn&amp;#39;t use nested_vmx_vmexit() as that API is intended to be used if and<br /> only if L2 is active, and the open coded equivalent neglects to put the<br /> vmcs12 pages. Failure to put the vmcs12 pages leaks any pinned pages<br /> (and/or mappings) if L1 retries VMLAUNCH/VMRESUME.<br /> <br /> Note, the !from_vmenter scenario doesn&amp;#39;t suffer the same problem, as<br /> vmx_get_nested_state_pages() only gets/pins/maps the vmcs12 pages if L2 is<br /> active, i.e. if a "full" VM-Exit is guaranteed before KVM will retry<br /> getting vmcs12 pages.