{"schema":"threatline.record/2","record":{"id":"CVE-2026-98720","aliases":[],"summary":"KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified\n\nForce a refresh of the vmcs02 MSR bitmap during nested VM-Enter if the\nruntime eVMCS controls (pin, primary, secondary, etc.) are being updated.\nIf L1 isn't intercepting TPR writes, runs L2 with TPR virtualization, and\nthen runs the same L2 with TPR virtualization disabled, KVM will fail to\nrefresh msr_bitmap02 and leave TPR in passthrough mode even though TPR\nvirtualization is disabled.  I.e. failure to refresh the bitmap lets L2 (or\nL1 by proxy) read and write L0's TPR.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98720","source_modified_at":"2026-10-19T09:24:31.090Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"502d2bf5f2fd7c05adc2d4f057910bd5d4c4c63e","lessThan":"2db11598b59f16ddb6420693f9a4ac4efc3d4789","status":"affected","versionType":"git"},{"version":"502d2bf5f2fd7c05adc2d4f057910bd5d4c4c63e","lessThan":"f6189e26d0237e47e2f04f9cb1e43fd19a9b2f3a","status":"affected","versionType":"git"},{"version":"502d2bf5f2fd7c05adc2d4f057910bd5d4c4c63e","lessThan":"1e497e3bdab6983deb68a1d26b488027deb4527f","status":"affected","versionType":"git"},{"version":"502d2bf5f2fd7c05adc2d4f057910bd5d4c4c63e","lessThan":"2abb25273c82061dd4670690c81c319c03740bf6","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98720","source_modified_at":"2026-10-19T09:24:31.090Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"5.17","status":"affected"},{"version":"0","lessThan":"5.17","status":"unaffected","versionType":"semver"},{"version":"6.12.113","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.56","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.10","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98720","source_modified_at":"2026-10-19T09:24:31.090Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"2db11598b59f16ddb6420693f9a4ac4efc3d4789","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98720","source_modified_at":"2026-10-19T09:24:31.090Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"1e497e3bdab6983deb68a1d26b488027deb4527f","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98720","source_modified_at":"2026-10-19T09:24:31.090Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"2abb25273c82061dd4670690c81c319c03740bf6","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":0.00168,"percentile":0.05723,"score_date":"2026-10-23"},"published_at":"2026-10-18T15:46:55.863Z","modified_at":"2026-10-19T09:24:31.090Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-98720","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T09:24:31.090Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98720","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/2db11598b59f16ddb6420693f9a4ac4efc3d4789"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/f6189e26d0237e47e2f04f9cb1e43fd19a9b2f3a"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/1e497e3bdab6983deb68a1d26b488027deb4527f"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/2abb25273c82061dd4670690c81c319c03740bf6"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T09:24:31.090Z","content_hash":"aa0c33658e670a6df6f1721726c1a74d002b9465135a420f7e85ea623e56e939"}}