{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry  Reset the vCPU's MMU pointer back to the root MMU if loading L2 state fails in the \"not from VM-Entry\" case, i.e. when emulating RSM or handling KVM_SET_NESTED_STATE.  Failure to unwind the MMU pointer results in KVM trying to run L1 with a nested MMU, and is especially problematic if the vCPU manages to free its nested state before the VM crashes.  Constructing the root for a nested EPT MMU goes through vmcs12, which is dynamically allocated/freed when nVMX is enabled/disabled.  And so if the nested state is freed with the MMU still pointing at the nested MMU, KVM will hit a NULL pointer deref when attempting to get L1=\u003eL2 EPTP.    BUG: kernel NULL pointer dereference, address: 0000000000000078   #PF: supervisor read access in kernel mode   #PF: error_code(0x0000) - not-present page   PGD 114a2d067 P4D 111743067 PUD 11141f067 PMD 0   Oops: Oops: 0000 [#1] SMP   CPU: 20 UID: 1000 PID: 1272 Comm: nested_tdp_faul Not tainted 7.3.0-rc4-8c89f11d1a99b-sink-vm #1914 PREEMPTLAZY   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015   RIP: 0010:nested_ept_get_eptp+0xb/0x10 [kvm_intel]   Call Trace:    \u003cTASK\u003e    kvm_mmu_load+0xcd/0x870 [kvm]    kvm_arch_vcpu_ioctl_run+0x18f5/0x1f80 [kvm]    kvm_vcpu_ioctl+0x2c7/0x970 [kvm]    __x64_sys_ioctl+0x90/0xd0    do_syscall_64+0x9c/0x4d0    entry_SYSCALL_64_after_hwframe+0x4b/0x53   RIP: 0033:0x47491b    \u003c/TASK\u003e   Modules linked in: kvm_intel kvm irqbypass   CR2: 0000000000000078   ---[ end trace 0000000000000000 ]---   RIP: 0010:nested_ept_get_eptp+0xb/0x10 [kvm_intel]  [sean: write changelog]",
  "id": "DEBIAN-CVE-2026-99176",
  "modified": "2026-10-29T05:47:41.534808382Z",
  "published": "2026-10-28T11:17:38.270Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-99176"
    }
  ],
  "upstream": [
    "CVE-2026-99176"
  ]
}