{"id":"CVE-2026-89932","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Always flush vpid02 on first use\n\nMake sure vpid02 is always flushed on first use by setting last_vpid=0\nwhen allocating vpid02","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Always flush vpid02 on first use\n\nMake sure vpid02 is always flushed on first use by setting last_vpid=0\nwhen allocating vpid02.  nested_vmx_transition_tlb_f…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 26de0d2d9a8d14c03e5ebb25fd68b5bfcd5ac366","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 8bc609999ec223089fec8d74c7de27d689606b36","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 62604376c313178811375f40a282fc2a46cd2311","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 8b98d662ab24f34710a56e03bc9169e4a5508606","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 22dfcc22c95e91295119a1c3b469816ce44c4804","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 121991d150735f3c0f7401678ce4d35c5b4ac898","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f0772389413dce9657c7d6950abf3edbbd511356","Linux < 5.15.221","Linux < 6.1.188","Linux < 6.6.157","Linux < 6.12.110","Linux < 6.18.51","Linux < 7.2.5","Linux (all versions)"],"published":"2026-09-16","updated":"2026-09-17","sourceUpdated":"2026-09-17T10:17:05.073","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89932","references":[{"url":"https://git.kernel.org/stable/c/121991d150735f3c0f7401678ce4d35c5b4ac898","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/22dfcc22c95e91295119a1c3b469816ce44c4804","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/26de0d2d9a8d14c03e5ebb25fd68b5bfcd5ac366","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/62604376c313178811375f40a282fc2a46cd2311","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b98d662ab24f34710a56e03bc9169e4a5508606","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8bc609999ec223089fec8d74c7de27d689606b36","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f0772389413dce9657c7d6950abf3edbbd511356","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-16T10:53:53.969Z","epss":0.00164,"epssPercentile":0.06015,"slug":"CVE-2026-89932","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Always flush vpid02 on first use\n\nMake sure vpid02 is always flushed on first use by setting last_vpid=0\nwhen allocating vpid02.  nested_vmx_transition_tlb_flush() will always\ndetect a VPID change on first VM-Enter after VMXON, because VPID=0 in\nvmcs12 is not allowed if L1 enables VPID.\n\nThis avoids using stale TLB entries from a previous lifetime of the\nVPID, that might have been associated with a different vCPU (or a\ncompletely different VM).\n\nNote that last_vpid is already being initialized as 0 when the vCPU is\ncreated, but it is not reset when vpid02 is freed on VMXOFF. Hence, the\nproblem can only occur if L1 does VMXOFF -> VMXON, runs an L2, and KVM\nhappens to reuse a VPID that has TLB entries on the physical CPU.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":205109,"id":"CVE-2026-89932","ts":1789570705270,"field":"cvss","old":null,"new":"8.8"},{"seq":205108,"id":"CVE-2026-89932","ts":1789570705270,"field":"severity","old":"none","new":"high"}]}