---
id: CVE-2026-89932
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: nVMX: Always flush vpid02 on first use

  Make sure vpid02 is always flushed on first use by setting last_vpid=0
  when allocating vpid02
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: nVMX: Always flush vpid02 on first use

  Make sure vpid02 is always flushed on first use by setting last_vpid=0
  when allocating vpid02.  nested_vmx_transition_tlb_f…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    26de0d2d9a8d14c03e5ebb25fd68b5bfcd5ac366
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    8bc609999ec223089fec8d74c7de27d689606b36
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    62604376c313178811375f40a282fc2a46cd2311
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    8b98d662ab24f34710a56e03bc9169e4a5508606
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    22dfcc22c95e91295119a1c3b469816ce44c4804
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    121991d150735f3c0f7401678ce4d35c5b4ac898
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    f0772389413dce9657c7d6950abf3edbbd511356
  - Linux < 5.15.221
  - Linux < 6.1.188
  - Linux < 6.6.157
  - Linux < 6.12.110
  - Linux < 6.18.51
  - Linux < 7.2.5
  - Linux (all versions)
published: '2026-09-16'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T10:17:05.073'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89932'
references:
  - url: 'https://git.kernel.org/stable/c/121991d150735f3c0f7401678ce4d35c5b4ac898'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/22dfcc22c95e91295119a1c3b469816ce44c4804'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/26de0d2d9a8d14c03e5ebb25fd68b5bfcd5ac366'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/62604376c313178811375f40a282fc2a46cd2311'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8b98d662ab24f34710a56e03bc9169e4a5508606'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8bc609999ec223089fec8d74c7de27d689606b36'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f0772389413dce9657c7d6950abf3edbbd511356'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:53.969Z'
epss: 0.00164
epssPercentile: 0.06031
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

KVM: nVMX: Always flush vpid02 on first use

Make sure vpid02 is always flushed on first use by setting last_vpid=0
when allocating vpid02.  nested_vmx_transition_tlb_flush() will always
detect a VPID change on first VM-Enter after VMXON, because VPID=0 in
vmcs12 is not allowed if L1 enables VPID.

This avoids using stale TLB entries from a previous lifetime of the
VPID, that might have been associated with a different vCPU (or a
completely different VM).

Note that last_vpid is already being initialized as 0 when the vCPU is
created, but it is not reset when vpid02 is freed on VMXOFF. Hence, the
problem can only occur if L1 does VMXOFF -> VMXON, runs an L2, and KVM
happens to reuse a VPID that has TLB entries on the physical CPU.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.