{"api_version":"1","generated_at":"2026-08-21T01:54:22+00:00","cve":"CVE-2026-72287","urls":{"html":"https://cve.report/CVE-2026-72287","api":"https://cve.report/api/cve/CVE-2026-72287.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-72287","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-72287"},"summary":{"title":"KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into \"normal\" checks","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Move vTPR vs. TPR Threshold consistency check into \"normal\" checks\n\nMove the off-by-default consistency check for vmcs12.tpr_threshold vs.\nthe virtual APIC vTPR into the \"normal\" controls checks, as waiting until\nKVM has loaded some amount of state is unnecessary and actively dangerous.\nSpecifically, failure to unwind vmcs01.GUEST_CR3 to KVM's value when EPT\nis disabled results in KVM running L1 with an L1-controlled CR3, not with\nKVM's CR3!\n\nAlternatively, KVM could simply reset the MMU to force a reload of\nvmcs01.GUEST_CR3, but the _only_ reason the check was shoved into a \"late\"\nflow was to wait until the vmcs12 pages were retrieved.  Rather than build\nup more crusty code, simply access vTPR using a regular guest memory access\n(performance isn't a concern).  To circumvent the restrictions that led to\nKVM deferring nested_get_vmcs12_pages(), (a) use a VM-scoped API to read\nguest memory so that it always hits non-SMM memslots (for RSM), and (b)\nskip the check (since its off-by-default anyways) when the vCPU doesn't\nwant to run, i.e. when userspace is restoring/stuffing state.\n\nIf reading guest memory fails, simply skip the consistency check, as KVM's\nde facto ABI is that VMX instruction accesses to non-existent memory get\nPCI Bus Error semantics, where reads return 0xFFs.  And if vTPR=0xFF, then\nthe vTPR is guaranteed to be greater than or equal to TPR_THRESHOLD.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-15 06:22:00","updated_at":"2026-08-17 06:18:31"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/ebdac7554abb347ca4197be241116842161acd9b","name":"https://git.kernel.org/stable/c/ebdac7554abb347ca4197be241116842161acd9b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7d066368f72e6192af7e21c5817626f6da666991","name":"https://git.kernel.org/stable/c/7d066368f72e6192af7e21c5817626f6da666991","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72287","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72287","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1100e4910ad207bc00aedc8dfdb228dd1b81f310 7d066368f72e6192af7e21c5817626f6da666991 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1100e4910ad207bc00aedc8dfdb228dd1b81f310 ebdac7554abb347ca4197be241116842161acd9b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.19","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.19 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.5 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"72287","cve":"CVE-2026-72287","epss":"0.001410000","percentile":"0.039650000","score_date":"2026-08-17","updated_at":"2026-08-18 00:11:47"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kvm/vmx/nested.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7d066368f72e6192af7e21c5817626f6da666991","status":"affected","version":"1100e4910ad207bc00aedc8dfdb228dd1b81f310","versionType":"git"},{"lessThan":"ebdac7554abb347ca4197be241116842161acd9b","status":"affected","version":"1100e4910ad207bc00aedc8dfdb228dd1b81f310","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kvm/vmx/nested.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.5","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Move vTPR vs. TPR Threshold consistency check into \"normal\" checks\n\nMove the off-by-default consistency check for vmcs12.tpr_threshold vs.\nthe virtual APIC vTPR into the \"normal\" controls checks, as waiting until\nKVM has loaded some amount of state is unnecessary and actively dangerous.\nSpecifically, failure to unwind vmcs01.GUEST_CR3 to KVM's value when EPT\nis disabled results in KVM running L1 with an L1-controlled CR3, not with\nKVM's CR3!\n\nAlternatively, KVM could simply reset the MMU to force a reload of\nvmcs01.GUEST_CR3, but the _only_ reason the check was shoved into a \"late\"\nflow was to wait until the vmcs12 pages were retrieved.  Rather than build\nup more crusty code, simply access vTPR using a regular guest memory access\n(performance isn't a concern).  To circumvent the restrictions that led to\nKVM deferring nested_get_vmcs12_pages(), (a) use a VM-scoped API to read\nguest memory so that it always hits non-SMM memslots (for RSM), and (b)\nskip the check (since its off-by-default anyways) when the vCPU doesn't\nwant to run, i.e. when userspace is restoring/stuffing state.\n\nIf reading guest memory fails, simply skip the consistency check, as KVM's\nde facto ABI is that VMX instruction accesses to non-existent memory get\nPCI Bus Error semantics, where reads return 0xFFs.  And if vTPR=0xFF, then\nthe vTPR is guaranteed to be greater than or equal to TPR_THRESHOLD."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached when an L1 nested-hypervisor guest executes VMLAUNCH/VMRESUME, driving KVM nested VM-Enter handling during KVM_RUN; no network, adjacent-radio, or physical-access path reaches this nVMX code.\nAC:H - Exploitation requires host EPT disabled (enable_ept=0) and the off-by-default developer warn_on_missed_cc module parameter; both are non-default host settings the attacking guest cannot enable, even though VMCS12/vAPIC fields are attacker-controlled once present.\nPR:L - The attacker needs ring-0 inside an L1 guest VM with nested VMX available (a typical nested-virt cloud tenant running its own hypervisor); no init-namespace host root or CAP_SYS_ADMIN on the host is required beyond ordinary VM execution.\nUI:N - Once nested virtualization is available, the malicious L1 hypervisor triggers the flaw solely via its own VMX instructions and crafted VMCS12/virtual-APIC state; no separate victim user action is required.\nS:C - Failure to restore vmcs01.GUEST_CR3 after the late VM-Fail leaves KVM running L1 with L1-controlled paging instead of KVM shadow CR3, crossing the guest/hypervisor isolation boundary in the classic KVM nested VMX guest-to-host escape class.\nC:H - Running L1 with its own CR3 under shadow paging (EPT disabled) lets the guest use attacker-chosen page tables to read host physical memory and kernel data outside its memslots, yielding arbitrary host information disclosure.\nI:H - The same CR3 confusion gives L1 arbitrary control over host physical mappings, enabling modification of host kernel structures and potential host code execution rather than a benign, correctly unwound VM-Fail.\nA:H - Beyond VM escape, inconsistent host CR3/paging state can oops or panic the host kernel when KVM resumes L1, denying availability to all co-resident VMs on the hypervisor."}]}],"providerMetadata":{"dateUpdated":"2026-08-17T05:42:22.571Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/7d066368f72e6192af7e21c5817626f6da666991"},{"url":"https://git.kernel.org/stable/c/ebdac7554abb347ca4197be241116842161acd9b"}],"title":"KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into \"normal\" checks","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-72287","datePublished":"2026-08-15T05:55:09.624Z","dateReserved":"2026-08-09T03:40:39.917Z","dateUpdated":"2026-08-17T05:42:22.571Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-15 06:22:00","lastModifiedDate":"2026-08-17 06:18:31","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.1,"impactScore":6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"72287","Ordinal":"1","Title":"KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into \"n","CVE":"CVE-2026-72287","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"72287","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Move vTPR vs. TPR Threshold consistency check into \"normal\" checks\n\nMove the off-by-default consistency check for vmcs12.tpr_threshold vs.\nthe virtual APIC vTPR into the \"normal\" controls checks, as waiting until\nKVM has loaded some amount of state is unnecessary and actively dangerous.\nSpecifically, failure to unwind vmcs01.GUEST_CR3 to KVM's value when EPT\nis disabled results in KVM running L1 with an L1-controlled CR3, not with\nKVM's CR3!\n\nAlternatively, KVM could simply reset the MMU to force a reload of\nvmcs01.GUEST_CR3, but the _only_ reason the check was shoved into a \"late\"\nflow was to wait until the vmcs12 pages were retrieved.  Rather than build\nup more crusty code, simply access vTPR using a regular guest memory access\n(performance isn't a concern).  To circumvent the restrictions that led to\nKVM deferring nested_get_vmcs12_pages(), (a) use a VM-scoped API to read\nguest memory so that it always hits non-SMM memslots (for RSM), and (b)\nskip the check (since its off-by-default anyways) when the vCPU doesn't\nwant to run, i.e. when userspace is restoring/stuffing state.\n\nIf reading guest memory fails, simply skip the consistency check, as KVM's\nde facto ABI is that VMX instruction accesses to non-existent memory get\nPCI Bus Error semantics, where reads return 0xFFs.  And if vTPR=0xFF, then\nthe vTPR is guaranteed to be greater than or equal to TPR_THRESHOLD.","Type":"Description","Title":"KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into \"n"}]}}}