CVE-2026-64562

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the KVM nVMX component where the free nested() function frees the shadow VMCS while vmcs01 still points to it. Due to the asynchronous nature of loaded vmcs clear(), a vCPU might migrate before the pointer is cleared, leading loaded vmcs clear() to execute VMCLEAR on a freed page. The VMCS must remain attached until the explicit VMCLEAR operation completes before it can be hidden and the page freed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.