{"id":"CVE-2026-89932","summary":"KVM: nVMX: Always flush vpid02 on first use","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Always flush vpid02 on first use\n\nMake sure vpid02 is always flushed on first use by setting last_vpid=0\nwhen allocating vpid02.  nested_vmx_transition_tlb_flush() will always\ndetect a VPID change on first VM-Enter after VMXON, because VPID=0 in\nvmcs12 is not allowed if L1 enables VPID.\n\nThis avoids using stale TLB entries from a previous lifetime of the\nVPID, that might have been associated with a different vCPU (or a\ncompletely different VM).\n\nNote that last_vpid is already being initialized as 0 when the vCPU is\ncreated, but it is not reset when vpid02 is freed on VMXOFF. Hence, the\nproblem can only occur if L1 does VMXOFF -\u003e VMXON, runs an L2, and KVM\nhappens to reuse a VPID that has TLB entries on the physical CPU.","modified":"2026-09-25T18:26:53.746274099Z","published":"2026-09-16T10:32:22.886Z","related":["openSUSE-SU-2026:11880-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89932.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/121991d150735f3c0f7401678ce4d35c5b4ac898"},{"type":"WEB","url":"https://git.kernel.org/stable/c/22dfcc22c95e91295119a1c3b469816ce44c4804"},{"type":"WEB","url":"https://git.kernel.org/stable/c/26de0d2d9a8d14c03e5ebb25fd68b5bfcd5ac366"},{"type":"WEB","url":"https://git.kernel.org/stable/c/62604376c313178811375f40a282fc2a46cd2311"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8b98d662ab24f34710a56e03bc9169e4a5508606"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8bc609999ec223089fec8d74c7de27d689606b36"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f0772389413dce9657c7d6950abf3edbbd511356"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89932.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89932"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5c614b3583e7b6dab0c86356fa36c2bcbb8322a0"},{"fixed":"26de0d2d9a8d14c03e5ebb25fd68b5bfcd5ac366"},{"fixed":"8bc609999ec223089fec8d74c7de27d689606b36"},{"fixed":"62604376c313178811375f40a282fc2a46cd2311"},{"fixed":"8b98d662ab24f34710a56e03bc9169e4a5508606"},{"fixed":"22dfcc22c95e91295119a1c3b469816ce44c4804"},{"fixed":"121991d150735f3c0f7401678ce4d35c5b4ac898"},{"fixed":"f0772389413dce9657c7d6950abf3edbbd511356"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-89932.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"5.15.221"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.188"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.157"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.110"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.51"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-89932.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}