The vulnerability in the Linux kernel's KVM TDX module (CVE-2026-72285) arises from a race condition where userspace can change the cpuid.nent field between the initial read and the subsequent copy of initialization data during the KVM_TDX_INIT_VM process. Specifically, tdx_td_init() reads cpuid.nent to size the memory allocation for the flexible kvm_tdx_init_vm structure, which includes cpuid.nent itself. If userspace modifies cpuid.nent concurrently, the copied count may differ from the allocation size, leading to potential out-of-bounds access when setup_tdparams_cpuids() calls kvm_find_cpuid_entry2() using the inconsistent cpuid.nent as the array bound. The patch requires the copied cpuid.nent count to match the initially read value, rejecting the initialization if they differ, thus preventing improper CPUID parsing beyond allocated entries.

This vulnerability could lead to out-of-bounds memory access during CPUID parsing in the KVM TDX initialization process, which may cause kernel memory corruption or crashes. However, no known exploits in the wild have been reported. The impact is limited to the Linux kernel's KVM TDX virtualization feature and requires concurrent modification by userspace during VM initialization.

A fix has been implemented in the Linux kernel to reject KVM_TDX_INIT_VM calls if the cpuid.nent value changes concurrently during initialization. Users should update to the fixed Linux kernel version once available. Patch status is not yet confirmed in the provided data; users should consult the official Linux kernel advisories or vendor updates for the exact fixed versions and apply those updates accordingly.