CVE-2026-89932

In the Linux kernel, the following vulnerability has been resolved:

KVM: nVMX: Always flush vpid02 on first use

Make sure vpid02 is always flushed on first use by setting last_vpid=0

when allocating vpid02. nested_vmx_transition_tlb_flush() will always

detect a VPID change on first VM-Enter after VMXON, because VPID=0 in

vmcs12 is not allowed if L1 enables VPID.

This avoids using stale TLB entries from a previous lifetime of the

VPID, that might have been associated with a different vCPU (or a

completely different VM).

Note that last_vpid is already being initialized as 0 when the vCPU is

created, but it is not reset when vpid02 is freed on VMXOFF. Hence, the

problem can only occur if L1 does VMXOFF -> VMXON, runs an L2, and KVM

happens to reuse a VPID that has TLB entries on the physical CPU.