CVE-2026-72285

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the KVM TDX implementation where a race condition occurs if userspace modifies the cpuid.nent variable between the initial read and the subsequent copy of initialization data. The tdx td init() function uses user data->cpuid.nent to determine the size of the kvm tdx init vm copy. If the value of cpuid.nent is changed concurrently, the copied structure may contain a different value than the one used for allocation. Subsequently, setup tdparams cpuids() passes init vm->cpuid.nent to kvm find cpuid entry2(), which uses it as the array bound for the copied entries, potentially allowing access beyond the allocated memory during CPUID parsing.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.