CVE-2026-68081: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-68081 is a memory leak vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem, specifically in the nested VMX (nVMX) implementation. When KVM synthesizes a nested VM-Exit due to invalid guest state while emulating VMLAUNCH or VMRESUME instructions, it fails to properly release ("put") vmcs12 pages, causing pinned kernel pages and/or memory mappings to leak if L1 retries the operation. The vulnerability affects Linux kernel versions from 5.2 up to (but not including) the fixed commits, with patched versions available at 6.18.40 and 7.1.5. The CVSS category is estimated as Medium, with an EPSS score of approximately 0.206% (Github Advisory, Feedly).

The root cause is a resource management flaw (related to CWE-401: Missing Release of Memory after Effective Lifetime) in the Linux kernel's KVM: nVMX code path. When a nested VM-Enter fails due to invalid guest state, the code uses an open-coded equivalent of nested_vmx_vmexit() rather than the API itself — because nested_vmx_vmexit() is only valid when L2 is active — but this open-coded path omits the call to release vmcs12 pages. As a result, each failed VMLAUNCH or VMRESUME attempt that triggers this path leaks pinned pages and/or memory mappings. The !from_vmenter scenario is unaffected because vmx_get_nested_state_pages() only pins vmcs12 pages when L2 is already active, ensuring a full VM-Exit occurs before any retry (Github Advisory).

Successful exploitation causes a kernel memory leak that progressively exhausts pinned kernel pages and memory mappings on the host system. A local attacker with KVM privileges can repeatedly trigger VMLAUNCH/VMRESUME with invalid guest states to accumulate leaked pages, degrading system performance and potentially causing a denial of service condition. The impact is limited to availability; there is no evidence of confidentiality or integrity compromise associated with this vulnerability (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. Exploitation requires local access with KVM privileges, significantly limiting the attack surface. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.206%, reflecting a low probability of exploitation in the near term (Github Advisory, Feedly).

Patches are available in Linux kernel versions 6.18.40 and 7.1.5, as well as in the 7.2-rc4 release candidate. The fix ensures vmcs12 pages are properly released when KVM synthesizes a nested VM-Exit due to invalid guest state. Administrators should update to a patched kernel version as the primary remediation. As a workaround, restricting KVM/nested virtualization access to trusted users only reduces exposure. Monitoring kernel memory usage for signs of page pinning leaks in virtualized environments is also recommended (Github Advisory, Feedly).