CVE-2026-68093

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the KVM SVM implementation where a virtual CPU (vCPU) may use an Address Space Identifier (ASID) already assigned to another vCPU after a physical CPU (pCPU) hotplug cycle (online to offline to online). This occurs because the svm enable virtualization cpu() function resets the asid generation variable to 1 during every CPU online event. If a vCPU resumes execution on a pCPU it previously used, it may bypass the generation check in pre svm run() and continue using a stale ASID. This leads to the sharing of Nested Page Table (NPT) Translation Lookaside Buffer (TLB) entries between different virtual machines, resulting in stale memory translations. This typically manifests as a KVM internal emulation failure when executing FPU or XSave instructions such as XRSTOR or STMXCSR.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.