{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-64562",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-64562"
  ],
  "published": "2026-08-04T06:22:25Z",
  "summary": "KVM: nVMX: Hide shadow VMCS right after VMCLEAR",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Hide shadow VMCS right after VMCLEAR\n\nfree_nested() frees the shadow VMCS while vmcs01 still points to it. But\nbecause it is asynchronous with respect to loaded_vmcs_clear(), the vCPU\nmight migrate before the pointer is cleared and __loaded_vmcs_clear()\nmay then execute VMCLEAR.\n\nThe VMCS needs to stay attached until its explicit VMCLEAR completes, but\nthen it can be hidden and the page safely freed.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.183",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64562"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/b82c3144d8264265448292ca406f60bafeba3b6f"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/4f50e6aec16f69627dbad5704d1e90a255d766a7"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/dc3eecfa219ebc9d01eaf7d1abd1441efe884dab"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/af56298e9d86e6098cd1d2e155cb2949b7c45412"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/589419470030a89f16cf19300658b6dc644ca946"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/8001d2ce9d9bd09118ce523aef595aa094573ae3"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1dabef6e206568bf9d9ade74f6e56a48ea35695d"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/622ebfac01ba4f9c0060cebd41257fe46fc4a0b3"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-19T16:47:12Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 8.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The bug is reached through local KVM nested VMX: open /dev/kvm, run a nested guest, then tear down nested state (VMXOFF/handle_vmxoff or vmx_leave_nested). It is not reachable via network or adjacent-radio packets.\nAC:L - A KVM VMM attacker controls both sides of the race by driving nested teardown (VMXOFF/vcpu destroy) while forcing vCPU migration via thread affinity/scheduling so __loaded_vmcs_clear() VMCLEARs the dangling shadow VMCS pointer.\nPR:L - Exploitation needs permission to use /dev/kvm and nested VMX (commonly kvm-group or equivalent), not real init-namespace root; KVM create/run ioctls have no CAP_SYS_ADMIN gate on this path.\nUI:N - After the attacker has KVM/nested access, they trigger free_nested and migration themselves; no separate victim action is required.\nS:C - free_nested runs in host KVM while handling L1 nested VMX teardown, and the UAF corrupts host kernel memory, crossing the guest/hypervisor isolation boundary (guest-to-host escape class).\nC:H - The dangling shadow VMCS pointer lets VMCLEAR operate on a freed page that may be reused, yielding a host kernel use-after-free that can be leveraged for arbitrary information disclosure.\nI:H - VMCLEAR writes VMCS state into the freed page; with page reuse this is host heap corruption enabling write primitives and potential host code execution, consistent with UAF guidance.\nA:H - Use-after-free of the shadow VMCS page can oops/panic the host kernel when VMCLEAR or later accessors touch reallocated memory, fully denying host availability."
    }
  }
}