{"id":"CVE-2026-98720","title":"KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified\n\nForce a refresh of the vmcs02 MSR bitmap during nested VM-Enter if the\nruntime eVMCS control…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 502d2bf5f2fd7c05adc2d4f057910bd5d4c4c63e < 2db11598b59f16ddb6420693f9a4ac4efc3d4789","Linux >= 502d2bf5f2fd7c05adc2d4f057910bd5d4c4c63e < f6189e26d0237e47e2f04f9cb1e43fd19a9b2f3a","Linux >= 502d2bf5f2fd7c05adc2d4f057910bd5d4c4c63e < 1e497e3bdab6983deb68a1d26b488027deb4527f","Linux >= 502d2bf5f2fd7c05adc2d4f057910bd5d4c4c63e < 2abb25273c82061dd4670690c81c319c03740bf6","Linux 5.17"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T15:46:55.863Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98720","references":[{"url":"https://git.kernel.org/stable/c/2db11598b59f16ddb6420693f9a4ac4efc3d4789"},{"url":"https://git.kernel.org/stable/c/f6189e26d0237e47e2f04f9cb1e43fd19a9b2f3a"},{"url":"https://git.kernel.org/stable/c/1e497e3bdab6983deb68a1d26b488027deb4527f"},{"url":"https://git.kernel.org/stable/c/2abb25273c82061dd4670690c81c319c03740bf6"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T16:47:32.510Z","slug":"CVE-2026-98720","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified\n\nForce a refresh of the vmcs02 MSR bitmap during nested VM-Enter if the\nruntime eVMCS controls (pin, primary, secondary, etc.) are being updated.\nIf L1 isn't intercepting TPR writes, runs L2 with TPR virtualization, and\nthen runs the same L2 with TPR virtualization disabled, KVM will fail to\nrefresh msr_bitmap02 and leave TPR in passthrough mode even though TPR\nvirtualization is disabled.  I.e. failure to refresh the bitmap lets L2 (or\nL1 by proxy) read and write L0's TPR.\n\n## Affected\n\n- `Linux >= 502d2bf5f2fd7c05adc2d4f057910bd5d4c4c63e < 2db11598b59f16ddb6420693f9a4ac4efc3d4789`\n- `Linux >= 502d2bf5f2fd7c05adc2d4f057910bd5d4c4c63e < f6189e26d0237e47e2f04f9cb1e43fd19a9b2f3a`\n- `Linux >= 502d2bf5f2fd7c05adc2d4f057910bd5d4c4c63e < 1e497e3bdab6983deb68a1d26b488027deb4527f`\n- `Linux >= 502d2bf5f2fd7c05adc2d4f057910bd5d4c4c63e < 2abb25273c82061dd4670690c81c319c03740bf6`\n- `Linux 5.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}