CVE-2026-64562

HighCVSS 8.8/10Last modified Nov 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: nVMX: Hide shadow VMCS right after VMCLEAR

free_nested() frees the shadow VMCS while vmcs01 still points to it. But because it is asynchronous with respect to loaded_vmcs_clear(), the vCPU might migrate before the pointer is cleared and __loaded_vmcs_clear() may then execute VMCLEAR.

The VMCS needs to stay attached until its explicit VMCLEAR completes, but then it can be hidden and the page safely freed.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5, < b82c3144d8264265448292ca406f60bafeba3b6f; >= 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5, < 4f50e6aec16f69627dbad5704d1e90a255d766a7; >= 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5, < dc3eecfa219ebc9d01eaf7d1abd1441efe884dab; >= 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5, < af56298e9d86e6098cd1d2e155cb2949b7c45412; >= 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5, < 589419470030a89f16cf19300658b6dc644ca946; >= 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5, < 8001d2ce9d9bd09118ce523aef595aa094573ae3; >= 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5, < 1dabef6e206568bf9d9ade74f6e56a48ea35695d; >= 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5, < 622ebfac01ba4f9c0060cebd41257fe46fc4a0b3
LinuxLinux4.9

References

Timeline

Published
Aug 4, 2026
Last modified
Nov 13, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-645637.8In the Linux kernel, the following vulnerability has been resolved: rhashtable: clear stale iter->p on table restart rhashtable_walk_startCVE-2026-645649.8In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_CVE-2026-64565In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() ThCVE-2026-645669.8In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags() WhenCVE-2026-645677.8In the Linux kernel, the following vulnerability has been resolved: btrfs: reject free space cache with more entries than pages When loadiCVE-2026-645687.8In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failureCVE-2026-64569In the Linux kernel, the following vulnerability has been resolved: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n On CVE-2026-64576.5The Geo Mashup plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geo_mashup_null_fields' parameter in all versioCVE-2026-645707.8In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix fils_discovery double free on alloc failure ieee80CVE-2026-64571In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate RX frame length in p54_rx_eeprom_readback() p54_rxCVE-2026-64572In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fib_alias with kfree_rcu() on insert error path fib_taCVE-2026-64573In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLV_
CVE-2026-64562: High severity, CVSS 8.8 | Vulnix