The vulnerability in the Linux kernel KVM nested virtualization (nVMX) involved deferring the consistency check between vmcs12.tpr_threshold and the virtual APIC vTPR until a late stage, which was unnecessary and dangerous. Specifically, failure to properly unwind vmcs01.GUEST_CR3 to KVM's value when EPT is disabled could result in KVM running the L1 guest with an L1-controlled CR3 instead of KVM's CR3. The fix moves this off-by-default consistency check into the normal control checks by accessing vTPR via regular guest memory access, skipping the check when the vCPU is not running, and handling read failures by skipping the check. This prevents the risk of running nested guests with incorrect memory management state.

If exploited, the vulnerability could cause KVM to run nested guests with an incorrect CR3 register, potentially leading to incorrect memory management behavior within the virtualized environment. This could undermine the isolation guarantees of nested virtualization. However, no known exploits are reported in the wild, and the issue is related to internal consistency checks within KVM's nested virtualization implementation.

A fix for this vulnerability has been implemented in the Linux kernel by moving the vTPR vs. TPR Threshold consistency check into the normal control checks. Users should apply the official Linux kernel updates that include this fix. Since no specific patch links or affected versions are provided, users should consult their Linux distribution or kernel vendor advisories for the relevant patched versions. No additional mitigations are indicated.