CVE-2026-64562: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64562 is a use-after-free vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) module, specifically in the nested VMX (nVMX) subsystem. The flaw arises because free_nested() frees the shadow VMCS (Virtual Machine Control Structure) while vmcs01 still holds a pointer to it, creating a race condition during vCPU migration. The vulnerability affects Linux kernel versions from 4.9 up to (but not including) the fixed releases: 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. It was published on August 4, 2026, with patches available on the same date. The CVSS base score is currently listed as 0.0 (pending full scoring), though Feedly estimates the severity as HIGH (GitHub Advisory, Feedly).

The root cause is a use-after-free condition (CWE-416) in the KVM nVMX shadow VMCS lifecycle management. Specifically, free_nested() frees the shadow VMCS page while vmcs01 still references it; because this freeing is asynchronous with respect to loaded_vmcs_clear(), a vCPU can migrate between the time the page is freed and the time the pointer is cleared, causing __loaded_vmcs_clear() to execute a VMCLEAR instruction on a freed VMCS pointer. The fix ensures the shadow VMCS is hidden (detached from vmcs01) immediately after VMCLEAR completes, before the page is freed, eliminating the race window. Exploitation requires local access to KVM functionality (i.e., the ability to create or manage VMs on the affected host) (GitHub Advisory, Feedly).

Successful exploitation of this use-after-free vulnerability can allow a local user with KVM access to achieve arbitrary code execution at kernel privilege level. This could result in full compromise of the host system, including access to all guest VMs running on the hypervisor, sensitive data exposure across VM boundaries, and potential for lateral movement within a cloud or virtualization environment. Availability impact includes potential kernel panic or system crash triggered by the race condition (GitHub Advisory, Feedly).

Patches are available in the following fixed Linux kernel versions: 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. Administrators should update to a patched kernel version as the primary remediation. As a temporary workaround, nested virtualization can be disabled if not required (e.g., by unloading or blacklisting the kvm_intel module with nested=0), or access to KVM functionality can be restricted to trusted users only (GitHub Advisory, Feedly).