CVE-2026-72285
In the Linux kernel, the following vulnerability has been resolved: KVM: TDX: Reject concurrent change to CPUID entry count Reject KVM_TDX_INIT_VM if userspace changes cpuid.nent between the initial read and the subsequent copy of the initialization data. tdx_td_init() first reads user_data->cpuid.nent to size the flexible kvm_tdx_init_vm copy. The copied structure also contains cpuid.nent, and that field can differ from the value used to size the allocation if userspace modifies the input concurrently. setup_tdparams_cpuids() later passes init_vm->cpuid.nent to kvm_find_cpuid_entry2(), which uses it as the array bound for the copied entries. Require the copied count to match the value used to size the allocation so that CPUID parsing cannot access beyond the entries actually copied.
Affected versions
Linux kernel versions
6.19
and later are affected. Fixed in
7.1.5,
7.2-rc4
and their respective stable series.
References
2 totalFrequently asked questions
-
What is CVE-2026-72285?
CVE-2026-72285 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.19 onward and has been patched in 7.1.5 and 7.2-rc4. CVE-2026-72285 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-72285?
Yes. CVE-2026-72285 has been patched. Fixed versions include 7.1.5 and 7.2-rc4. If you are running Linux kernel 6.19 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-72285 actively exploited?
No. CVE-2026-72285 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.