CVE-2026-99176

What it actually does

Failure to reset the vCPU MMU pointer from a nested MMU back to the root MMU on L2 state load failure leaves the MMU pointing at a freed vmcs12-backed nested EPT structure, resulting in a NULL pointer dereference inside nested_ept_get_eptp when KVM later attempts to load L1 state.

Why it matters to the business

Virtualization hosts running nested guests may experience sudden kernel crashes and guest downtime; the issue appears in recent kernels and affects environments that rely on KVM nested virtualization for testing or layered workloads.

How an attack unfolds

An attacker with the ability to trigger nested VMX state transitions (via RSM emulation or KVM_SET_NESTED_STATE) forces a failure path that leaves the MMU pointer dangling; subsequent vCPU run attempts dereference the now-freed nested state, producing a kernel NULL dereference that can be used for denial of service or, with additional primitives, local privilege escalation.

How to fix it

Update to a kernel containing the fix that restores the root MMU pointer on nested state load failure; apply the vendor-supplied KVM/nVMX patch and reboot affected hosts.

How to confirm the fix worked

Confirm the patch is present by checking the kernel changelog or git commit that added the MMU unwind on L2 failure; attempt to reproduce the original failure path in a nested test environment and verify the host no longer crashes.

Typical attack path

1. Obtain access to a KVM guest that has nested virtualization enabled
2. Issue nested state load or RSM operations that cause L2 state load to fail
3. Free or invalidate the nested VMCS structures while the MMU still references them
4. Trigger a vCPU run that walks the dangling nested MMU, causing the NULL dereference

How to detect it

Search kernel logs and dmesg for the exact oops signature containing nested_ept_get_eptp and the NULL pointer at address 0000000000000078; correlate with processes performing KVM ioctls or nested state operations.

• nested_ept_get_eptp+0xb/0x10 [kvm_intel]
• BUG: kernel NULL pointer dereference, address: 0000000000000078
• kvm_mmu_load+0xcd/0x870 [kvm]
• CR2: 0000000000000078

What your security team should do

• Prioritize patching KVM hosts that expose nested virtualization to untrusted guests
• Temporarily disable nested VMX (kvm_intel.nested=0) on systems where the feature is not required
• Monitor kernel logs for nested_ept_get_eptp oops entries until patches are deployed