SB20261022326 - Incorrect authorization in Linux kernel kvm vmx

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect authorization (CVE-ID: CVE-2026-98720)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to read and modify the host hypervisor's task priority register from a nested virtual machine.

The vulnerability exists due to incorrect access control caused by a stale MSR bitmap in the Linux kernel's KVM nested VMX implementation when runtime enlightened VMCS controls are modified. A local privileged user can configure an L1 hypervisor not to intercept TPR writes and run the same L2 guest first with TPR virtualization enabled and then disabled to read and write L0's task priority register.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1e497e3bdab6983deb68a1d26b488027deb4527f
• https://git.kernel.org/stable/c/2abb25273c82061dd4670690c81c319c03740bf6
• https://git.kernel.org/stable/c/2db11598b59f16ddb6420693f9a4ac4efc3d4789
• https://git.kernel.org/stable/c/f6189e26d0237e47e2f04f9cb1e43fd19a9b2f3a