In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails Re-pend… (CVE-2026-98863)

The vulnerability in the Linux kernel's KVM x86 virtualization involves the re-pending of GET_NESTED_STATE_PAGES if fetching these pages fails during the KVM_RUN execution path. Without proper re-pending, if userspace re-runs the virtual CPU (vCPU), the nested VMCS (vmcs02) may hold stale PFNs from a previous nested run, leading to stale, unpinned PFNs being mapped incorrectly, for example, into the virtual APIC page. The issue is mitigated in both SVM and VMX by ensuring the KVM_REQ_GET_NESTED_STATE_PAGES request is cleared on VM-Exit, including forced exits, thus preventing double-mapping due to emulated nested virtualization instructions.

The impact involves potential stale and unpinned memory pages being mapped during nested virtualization runs, which could lead to incorrect memory state or behavior in nested virtual machines. The exact security consequences are not detailed in the provided information. There are no known exploits in the wild.

A fix has been implemented in the Linux kernel to re-pend GET_NESTED_STATE_PAGES if fetching nested pages fails, preventing stale PFNs from being reused. Both SVM and VMX implementations clear the request on VM-Exit to avoid double-mapping. Users should update to the patched Linux kernel version containing this fix. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.