SB2026081695 - Out-of-bounds read in Linux kernel kvm vmx

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-72285)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in tdx_td_init() and CPUID parsing when processing a KVM_TDX_INIT_VM request with a concurrently modified cpuid entry count. A local user can modify cpuid.nent between the initial read and the subsequent copy to cause an out-of-bounds read.

The issue arises from a mismatch between the cpuid entry count used to size the copied initialization data and the count later used as the array bound during CPUID entry lookup.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/cfbebb55e5127dc162e73fa8956000055a78606c
• https://git.kernel.org/stable/c/d6b5aba65e99531c97b146622a406c75653819d5