{"id":"CVE-2026-99176","kind":"vulnerability","aliases":["CVE-2026-99176"],"related":[],"title":"Linux KVM nested VMX: failed L2 state load leaves NULL pointer dereference crash","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry\n\nReset the vCPU's MMU pointer back to the root MMU if loading L2 state fails\nin the \"not from VM-Entry\" case, i.e. when emulating RSM or handling\nKVM_SET_NESTED_STATE.  Failure to unwind the MMU pointer results in KVM\ntrying to run L1 with a nested MMU, and is especially problematic if the\nvCPU manages to free its nested state before the VM crashes.  Constructing\nthe root for a nested EPT MMU goes through vmcs12, which is dynamically\nallocated/freed when nVMX is enabled/disabled.  And so if the nested state\nis freed with the MMU still pointing at the nested MMU, KVM will hit a NULL\npointer deref when attempting to get L1=>L2 EPTP.\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000078\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 114a2d067 P4D 111743067 PUD 11141f067 PMD 0\n  Oops: Oops: 0000 [#1] SMP\n  CPU: 20 UID: 1000 PID: 1272 Comm: nested_tdp_faul Not tainted 7.3.0-rc4-8c89f11d1a99b-sink-vm #1914 PREEMPTLAZY\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  RIP: 0010:nested_ept_get_eptp+0xb/0x10 [kvm_intel]\n  Call Trace:\n   <TASK>\n   kvm_mmu_load+0xcd/0x870 [kvm]\n   kvm_arch_vcpu_ioctl_run+0x18f5/0x1f80 [kvm]\n   kvm_vcpu_ioctl+0x2c7/0x970 [kvm]\n   __x64_sys_ioctl+0x90/0xd0\n   do_syscall_64+0x9c/0x4d0\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x47491b\n   </TASK>\n  Modules linked in: kvm_intel kvm irqbypass\n  CR2: 0000000000000078\n  ---[ end trace 0000000000000000 ]---\n  RIP: 0010:nested_ept_get_eptp+0xb/0x10 [kvm_intel]\n\n[sean: write changelog]","summary":"When loading nested (L2) guest state fails during RSM emulation or KVM_SET_NESTED_STATE, the vCPU keeps using the nested MMU, and freeing the nested state then causes a kernel NULL pointer dereference. The sources describe a kernel oops that crashes the host; they do not describe code execution or data theft.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["intel-vmx","kvm","linux","nested-virtualization","runtime","self-hosted"],"not_affected_if":["managed-hosting","nested-disabled","no-kvm-intel"],"how_to_check":"- Check whether the host runs the kvm_intel module: `lsmod | grep kvm_intel`\n- Check whether nested virtualization is enabled: `cat /sys/module/kvm_intel/parameters/nested`\n- Check the running kernel version: `uname -r`","fix":"- Install a Linux kernel build that includes the upstream fix for CVE-2026-99176 (the sources do not name a fixed version: unknown)\n- Reboot into the patched kernel","status":"open","published_at":"2026-10-28T11:17:38+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","triaged_at":"2026-10-28T11:35:30+00:00","updated_at":"2026-10-28T11:35:30+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-28T11:35:30Z","model":"claude-haiku-5-5","output":{"fix":"- Install a Linux kernel build that includes the upstream fix for CVE-2026-99176 (the sources do not name a fixed version: unknown)\n- Reboot into the patched kernel","reach":"local","title":"Linux KVM nested VMX: failed L2 state load leaves NULL pointer dereference crash","impact":"medium","summary":"When loading nested (L2) guest state fails during RSM emulation or KVM_SET_NESTED_STATE, the vCPU keeps using the nested MMU, and freeing the nested state then causes a kernel NULL pointer dereference. The sources describe a kernel oops that crashes the host; they do not describe code execution or data theft.","category":"runtime","nicknames":[],"who_cares":["linux","kvm","intel-vmx","nested-virtualization","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"host kernel oops crashes the hypervisor and its guests","analyst_note":"Find the fixed kernel version and the upstream commit for CVE-2026-99176 on the NVD page or kernel.org stable mailing list; confirm whether an unprivileged guest can trigger it.","how_to_check":"- Check whether the host runs the kvm_intel module: `lsmod | grep kvm_intel`\n- Check whether nested virtualization is enabled: `cat /sys/module/kvm_intel/parameters/nested`\n- Check the running kernel version: `uname -r`","needs_analyst":true,"not_affected_if":["nested-disabled","no-kvm-intel","managed-hosting"],"who_is_affected":"Hosts running KVM with Intel VMX and nested virtualization enabled, where guests can trigger RSM emulation or nested state restore failures. Hosts without kvm_intel loaded, or with nesting disabled, are not exposed according to the description. Whether a guest can trigger this on its own is unknown.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000761,"input_tokens":4138,"output_tokens":695,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':303C,312C,320C,326C,332C,337C,344C,367C '-2026':15A,18A '-99176':16A,19A '0':260C '0.0.0':295C '0000':263C '0000000000000000':360C '0000000000000078':237C,357C '0010':298C,362C '0033':347C '02/06/2015':296C '0x0000':248C '0x47491b':348C '1':264C '1000':269C '11141f067':258C '111743067':256C '114a2d067':254C '1272':271C '1914':284C '20':267C '2009':293C '64':336C,341C '7.3.0':278C '8c89f11d1a99b':281C 'access':241C 'address':236C 'allocated/freed':195C 'arch':316C 'attempt':225C 'back':99C,119C 'bio':294C 'bug':231C 'call':307C 'case':136C 'caus':60B 'changelog':373C 'code':80B,247C 'comm':272C 'construct':181C 'cpu':266C 'cr2':356C 'crash':13A,73B,180C 'cve':14A,17A 'data':83B 'deref':223C 'derefer':12A,65B,235C 'describ':68B,79B 'dynam':194C 'emul':41B,139C 'enabled/disabled':199C 'end':358C 'entri':112C,135C,339C 'ept':187C,300C,364C 'eptp':230C,302C,366C 'error':246C 'especi':166C 'execut':81B 'fail':5A,38B,108C,128C 'failur':147C 'faul':275C 'follow':90C 'free':55B,173C 'freed':207C 'get':227C,301C,365C 'goe':189C 'guest':36B 'handl':142C 'hardwar':286C 'hit':219C 'host':31B,75B 'hwframe':343C 'i.e':137C 'ich9':292C 'intel':21B,306C,353C,370C 'intel-vmx':20B 'ioctl':318C,325C,331C 'irqbypass':355C 'keep':49B 'kernel':62B,70B,88C,232C,243C 'kvm':2A,23B,43B,95C,143C,155C,217C,305C,309C,314C,315C,322C,323C,328C,352C,354C,369C 'l1':159C,228C 'l2':6A,35B,106C,126C,229C 'leav':9A 'link':350C 'linux':1A,24B,87C 'load':8A,33B,105C,125C,311C 'manag':171C 'mmu':53B,98C,103C,117C,123C,151C,163C,188C,210C,216C,310C 'mode':244C 'modul':349C 'name':287C 'nest':3A,26B,34B,45B,52B,57B,145C,162C,175C,186C,204C,215C,273C,299C,363C 'nested-virtu':25B 'not-pres':249C 'null':10A,63B,221C,233C 'nvmx':96C,197C 'oop':71B,261C,262C 'p4d':255C 'page':252C 'pc':290C 'pf':238C,245C 'pgd':253C 'pid':270C 'pmd':259C 'point':212C 'pointer':11A,64B,118C,152C,222C,234C 'preemptlazi':285C 'present':251C 'problemat':167C 'pud':257C 'q35':291C 'qemu':288C 'rc4':280C 'rc4-8c89f11d1a99b-sink-vm':279C 'read':240C 'reset':97C,113C 'resolv':94C 'result':153C 'rip':297C,346C,361C 'root':102C,122C,183C 'rsm':40B,140C 'run':158C,319C 'runtim':28B 'sean':371C 'self':30B 'self-host':29B 'set':44B,144C 'sink':282C 'smp':265C 'sourc':67B 'standard':289C 'state':7A,37B,46B,58B,107C,127C,146C,176C,205C 'still':211C 'supervisor':239C 'sys':330C 'syscal':335C,340C 'taint':277C 'tdp':274C 'theft':84B 'trace':308C,359C 'tri':156C 'uid':268C 'unwind':149C 'use':50B 'vcpu':48B,115C,170C,317C,324C 'virtual':27B 'vm':111C,134C,179C,283C 'vm-entri':110C,133C 'vmcs12':191C 'vmx':4A,22B 'vulner':91C 'write':372C 'x18f5/0x1f80':321C 'x2c7/0x970':327C 'x4b/0x53':345C 'x64':329C 'x90/0xd0':333C 'x9c/0x4d0':338C 'xb/0x10':304C,368C 'xcd/0x870':313C","nicknames":[],"mitigations":[],"who_affected":"Hosts running KVM with Intel VMX and nested virtualization enabled, where guests can trigger RSM emulation or nested state restore failures. Hosts without kvm_intel loaded, or with nesting disabled, are not exposed according to the description. Whether a guest can trigger this on its own is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:38+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99176","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99176","severity":null,"published_at":"2026-10-28T11:17:38+00:00","modified_at":"2026-10-28T11:17:38+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","fetched_at":"2026-10-28T11:32:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}