CVE-2026-68081

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the KVM nVMX component where the system fails to release vmcs12 pages when a nested VM-Enter fails due to an invalid guest state during the emulation of VMLAUNCH or VMRESUME. This occurs because the invalid guest state path does not utilize the nested vmx vmexit() function, and the alternative implementation fails to release the pages. Consequently, this leads to a leak of pinned pages or mappings if the L1 hypervisor retries the VMLAUNCH or VMRESUME operations. The vmx get nested state pages() function is not affected in scenarios where L2 is inactive.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.