SB20261029119 - NULL pointer dereference in Linux kernel kvm vmx

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-99176)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel NULL pointer dereference.

The vulnerability exists due to a failure to restore the root MMU context in the Linux kernel's KVM nested VMX implementation when loading L2 state fails during RSM emulation or KVM_SET_NESTED_STATE handling. A local user can trigger this failure and subsequently free the nested virtualization state, leaving the vCPU using a nested MMU while running L1, to cause a NULL pointer dereference when KVM accesses the L1-to-L2 EPT pointer.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/c8f4cfe1cf93bce924e27f2abead7a4c4a487505
• https://git.kernel.org/stable/c/c9716f956216eb74ab0aad7f633586edd49e0322
• https://git.kernel.org/stable/c/d00d5f534a8238674755e59826a6c7d3c8efb870