KVM Flaw Breaks Isolation in Nested Virtualization

Security researchers reported a vulnerability in Linux's KVM hypervisor that allows a nested virtual machine to escape its isolation layer and access memory belonging to the higher-level hypervisor.

The issue arises in nested virtualization scenarios — common on cloud platforms offering VMs-within-VMs, such as CI/CD services or development sandboxes. Under specific Extended Page Table (EPT) configuration conditions, a malicious L2 VM can trick the L1 hypervisor into exposing memory pages belonging to the actual L0 hypervisor.

This breaks one of nested virtualization's fundamental guarantees: that each layer is fully isolated from the others. In multi-tenant environments where different customers share nested-virtualization infrastructure, this could let one tenant read another tenant's memory.

A patch is already available in the latest stable Linux kernels. Cloud operators offering nested virtualization should prioritize the update.