CVE intelligence

CVE-2026-72285

Vulnerability intelligence

Published Aug 15, 2026Sources checked Oct 8, 2026

7.8HIGHCVSS out of 10

What this means

Review the available evidence

CVE-2026-72285 and is rated High severity with a CVSS score of 7.8. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

CISA KEVNot listedBased on the latest collected catalog

EPSS0.2%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-72285?

In the Linux kernel, the following vulnerability has been resolved:

KVM: TDX: Reject concurrent change to CPUID entry count

Reject KVM_TDX_INIT_VM if userspace changes cpuid.nent between the initial read and the subsequent copy of the initialization data.

tdx_td_init() first reads user_data->cpuid.nent to size the flexible kvm_tdx_init_vm copy. The copied structure also contains cpuid.nent, and that field can differ from the value used to size the allocation if userspace modifies the input concurrently. setup_tdparams_cpuids() later passes init_vm->cpuid.nent to kvm_find_cpuid_entry2(), which uses it as the array bound for the copied entries.

Require the copied count to match the value used to size the allocation so that CPUID parsing cannot access beyond the entries actually copied.

Source: NVD