CVE-2026-72285 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: TDX: Reject concurrent change to CPUID entry count
Reject KVM_TDX_INIT_VM if userspace changes cpuid.nent between the initial read and the subsequent copy of the initialization data.
tdx_td_init() first reads user_data->cpuid.nent to size the flexible kvm_tdx_init_vm copy. The copied structure also contains cpuid.nent, and that field can differ from the value used to size the allocation if userspace modifies the input concurrently. setup_tdparams_cpuids() later passes init_vm->cpuid.nent to kvm_find_cpuid_entry2(), which uses it as the array bound for the copied entries.
Require the copied count to match the value used to size the allocation so that CPUID parsing cannot access beyond the entries actually copied.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability resides within the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem specifically affecting the TDX (Trusted Domain Extensions) implementation. The flaw manifests as a potential memory corruption issue that could be exploited through improper handling of CPUID entry counts during the TDX virtual machine initialization process. The vulnerability stems from a race condition scenario where concurrent modifications to the cpuid.nent field between initial read and subsequent data copying operations create a mismatch that allows for out-of-bounds memory access.
The technical implementation involves the tdx_td_init() function which first reads the user_data->cpuid.nent value to determine the appropriate allocation size for the flexible kvm_tdx_init_vm structure. During this process, the system allocates memory based on the initial cpuid.nent count obtained from userspace. However, if userspace modifies the cpuid.nent field concurrently between this initial read and the subsequent copy operation of initialization data, a discrepancy occurs between the allocation size and the actual data being copied. This mismatch is then passed to setup_tdparams_cpuids() function which uses init_vm->cpuid.nent as an array bound parameter for kvm_find_cpuid_entry2().
The operational impact of this vulnerability extends beyond simple memory corruption, potentially enabling privilege escalation and denial-of-service conditions within virtualized environments. Attackers could exploit this race condition to manipulate the CPUID entry count values, causing the system to access memory regions beyond the allocated boundaries during CPUID parsing operations. This represents a classic buffer overflow scenario where the bounds checking fails due to concurrent modification of critical parameters. The vulnerability aligns with CWE-129 and CWE-787 categories related to insufficient bounds checking and improper input validation.
From an ATT&CK perspective, this vulnerability maps to techniques involving privilege escalation through kernel exploits and system resource manipulation. The flaw could be leveraged by malicious actors to gain elevated privileges within virtual machine environments, potentially compromising the integrity of the entire virtualization stack. The exploitation requires careful timing and concurrent modification capabilities but represents a significant security risk in cloud computing and containerized environments where TDX is utilized.
Mitigation strategies include implementing proper synchronization mechanisms to prevent concurrent modifications during critical sections of the initialization process, ensuring atomic operations when reading and copying cpuid.nent values, and enforcing strict validation checks before memory allocation. The fix requires maintaining consistency between the initial read value and the subsequent copied value, eliminating the race condition that enables the out-of-bounds access pattern. System administrators should ensure timely patching of kernel versions containing this vulnerability while monitoring for any unusual behavior in virtualized environments where TDX functionality is active.