🟠 High | Source: Microsoft Security Response Center
CVE-2026-64562 is a vulnerability in the Linux Kernel Virtual Machine (KVM) hypervisor’s nested virtualisation (nVMX) component, where a shadow VMCS (Virtual Machine Control Structure) is not hidden immediately after a VMCLEAR operation. This timing flaw could allow a guest virtual machine to observe or interact with internal hypervisor state it should not have access to, potentially leaking sensitive control data. The issue is relevant to Azure as Microsoft’s infrastructure relies on KVM-based virtualisation, meaning tenant workloads could be affected.
Security Architect’s Take: Review whether your Azure-hosted workloads run in environments with nested virtualisation enabled, and monitor Microsoft’s patch release for this CVE — apply any guest OS or host updates promptly once available. If you operate sensitive multi-tenant workloads, consider raising the issue with your Microsoft account team to confirm patching timelines for the underlying host infrastructure.
Original advisory: CVE-2026-64562 KVM: nVMX: Hide shadow VMCS right after VMCLEAR