Linux Kernel KVM TDX tdx_td_init array index

Summaryinfo

A vulnerability, which was classified as very critical, was found in Linux Kernel. Affected by this vulnerability is the function tdx_td_init of the component KVM TDX. Such manipulation leads to array index. This vulnerability is documented as CVE-2026-72285. The attack needs to be performed locally. There is not any exploit available.

Detailsinfo

A vulnerability was found in Linux Kernel (affected version not known). It has been rated as very critical. Affected by this issue is the function tdx_td_init of the component KVM TDX. The manipulation with an unknown input leads to a array index vulnerability. Using CWE to declare the problem leads to CWE-129. The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array. Impacted is confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: KVM: TDX: Reject concurrent change to CPUID entry count Reject KVM_TDX_INIT_VM if userspace changes cpuid.nent between the initial read and the subsequent copy of the initialization data. tdx_td_init() first reads user_data->cpuid.nent to size the flexible kvm_tdx_init_vm copy. The copied structure also contains cpuid.nent, and that field can differ from the value used to size the allocation if userspace modifies the input concurrently. setup_tdparams_cpuids() later passes init_vm->cpuid.nent to kvm_find_cpuid_entry2(), which uses it as the array bound for the copied entries. Require the copied count to match the value used to size the allocation so that CPUID parsing cannot access beyond the entries actually copied.

The advisory is shared for download at git.kernel.org. This vulnerability is handled as CVE-2026-72285 since 08/09/2026. The exploitation is known to be easy. The attack needs to be approached locally. The exploitation needs additional levels of successful authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/15/2026).

Applying the patch d6b5aba65e99531c97b146622a406c75653819d5/cfbebb55e5127dc162e73fa8956000055a78606c is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion