In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified Force… (CVE-2026-98720)

The vulnerability in the Linux kernel's KVM nVMX implementation arises from not forcing a refresh of the vmcs02 MSR bitmap during nested VM-Enter when runtime eVMCS controls such as pin, primary, and secondary controls are updated. Specifically, if the first-level guest (L1) does not intercept TPR writes and runs the second-level guest (L2) with TPR virtualization enabled and then disabled, the MSR bitmap (msr_bitmap02) is not refreshed. This leaves the TPR in passthrough mode, allowing L2 or L1 by proxy to read and write the host's (L0) TPR, which is a breach of expected isolation.

This vulnerability could allow a nested guest virtual machine to access and modify the host's Task Priority Register (TPR) when it should not be able to, potentially breaking isolation guarantees between virtual machines. This could lead to unauthorized access or manipulation of host-level resources by nested guests.

A fix has been implemented in the Linux kernel to force a refresh of the vmcs02 MSR bitmap during nested VM-Enter when runtime eVMCS controls are modified. Users should apply the official Linux kernel updates that include this fix. No additional mitigation steps are indicated in the advisory.