CVE-2026-72285
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In the Linux kernel for KVM TDX, concurrent change to CPUID entry count during initialization is now rejected. Previously, a user could change cpuid.nent between read and copy, potentially leading to out-of-bounds access. The fix requires the copied count to match the value used for allocation.
Risk Assessment
Out-of-bounds access could lead to kernel memory disclosure or crash, posing a security risk.
Recommendation
Apply the Linux kernel update containing this fix to prevent CPUID issues.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: KVM: TDX: Reject concurrent change to CPUID entry count Reject KVM_TDX_INIT_VM if userspace changes cpuid.nent between the initial read and the subsequent copy of the initialization data. tdx_td_init() first reads user_data->cpuid.nent to size the flexible kvm_tdx_init_vm copy. The copied structure also contains cpuid.nent, and that field can differ from the value used to size the allocation if userspace modifies the input concurrently. setup_tdparams_cpuids() later passes init_vm->cpuid.nent to kvm_find_cpuid_entry2(), which uses it as the array bound for the copied entries. Require the copied count to match the value used to size the allocation so that CPUID parsing cannot access beyond the entries actually copied.