🟠 High | Source: Microsoft Security Response Center
CVE-2026-68081 is a vulnerability in the Linux KVM hypervisor’s nested virtualisation (nVMX) component, where virtual machine control structure (VMCS) pages are not properly released when a nested VM entry fails due to invalid guest state. This memory management flaw could lead to resource exhaustion or potentially be exploited to destabilise the host hypervisor. It is particularly relevant to Azure, where the underlying infrastructure relies on KVM-based virtualisation.
Security Architect’s Take: Monitor Microsoft’s patch guidance for affected Azure infrastructure and ensure any self-managed Linux KVM hosts (e.g. in IaaS or hybrid deployments) are patched promptly. If running nested virtualisation workloads on Azure or on-premises KVM, prioritise testing and applying the relevant kernel update.
Original advisory: CVE-2026-68081 KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state