CVE-2026-68081: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state

CSIRTS triage

What: KVM nVMX does not properly clean up vmcs12 pages when nested VM-Enter fails due to invalid guest state, leaving dangling references.
Who is affected: Linux systems using KVM hypervisor with nested virtualization (VMX) enabled.
Urgency: Unknown severity; memory management issue in guest setup error paths that may lead to instability or information disclosure.
Action: Apply Linux kernel patch that ensures vmcs12 pages are properly freed on nested VM-Enter failures.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Linux Kernel

Get an email when a new Linux Kernel advisory drops — max one per day, one-click unsubscribe.

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-680810.15% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all EPSS-scored CVEs.

CVE	CSIRTS overview	External
CVE-2026-68081	coverage & exploitation status	NVD · CVE.org

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.