In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use active memslots for the per-vCPU MMIO cache KVM tags the per-vCPU… (CVE-2026-99082)

The vulnerability in the Linux kernel KVM x86 component involved the per-vCPU MMIO cache using kvm_memslots() which always selected address space 0, even when the vCPU was running in SMM using address space 1. This caused updates to SMM memslots to leave stale cache entries valid after returning to normal address space, allowing a guest to trigger MMIO exits that bypass KVM's write-tracking. This could corrupt nested EPT shadow translations. The fix uses the vCPU's active memslots for caching and validation, distinguishing between normal and SMM address spaces by memslot generation, thus preventing stale cache entries and ensuring correct memory write tracking.

A guest VM could cause an access to valid RAM to be misclassified as an MMIO exit, leading to KVM bypassing its write-tracking mechanism. This could result in KVM using outdated shadow translations for nested EPT tables, potentially causing memory corruption or inconsistent virtualization behavior. However, there is no indication of remote code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel mainline that uses the vCPU's active memslots for the MMIO cache and validation, preventing stale cache entries across address spaces. Users should update to the patched kernel version containing commit 56f17dd3fbc4 and related fixes. Since this is a kernel-level fix, applying the official kernel update is the recommended remediation.