CVE-2026-72285: KVM: TDX: Reject concurrent change to CPUID entry count
In the Linux kernel, the following vulnerability has been resolved:
KVM: TDX: Reject concurrent change to CPUID entry count
Reject KVMTDXINITVM if userspace changes cpuid.nent between the initial read and the subsequent copy of the initialization data.
tdxtdinit() first reads userdata->cpuid.nent to size the flexible kvmtdxinitvm copy. The copied structure also contains cpuid.nent, and that field can differ from the value used to size the allocation if userspace modifies the input concurrently. setuptdparamscpuids() later passes initvm->cpuid.nent to kvmfindcpuidentry2(), which uses it as the array bound for the copied entries.
Require the copied count to match the value used to size the allocation so that CPUID parsing cannot access beyond the entries actually copied.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72285?
CVE-2026-72285 has a risk rating of 34, indicating a moderate severity level.
How do I fix CVE-2026-72285?
To mitigate CVE-2026-72285, ensure that userspace does not alter the cpuid.nent value during the initialization process.
What systems are affected by CVE-2026-72285?
CVE-2026-72285 affects systems running the Linux kernel with KVM and TDX support.
What type of vulnerability is CVE-2026-72285?
CVE-2026-72285 is categorized as a race condition vulnerability within the KVM subsystem of the Linux kernel.
When was CVE-2026-72285 published?
CVE-2026-72285 was published on August 15, 2026.