CVE-2026-68093: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-99gx-mqgq-5pqg
Share
Published
Advisory Summary

CVE-2026-68093 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-68093 at a Glance

CVE Identifier CVE-2026-68093
GHSA Identifier GHSA-99gx-mqgq-5pqg
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-68093

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-68093, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug If a vCPU stays scheduled out (or blocked) while the last pCPU it ran on goes through a hotplug cycle (online->offline->online), and the vCPU then resumes execution on the same pCPU, then it is possible for it to run with an ASID that has now been assigned to a different vCPU, resulting in stale TLB translations being used. svm_enable_virtualization_cpu() resets asid_generation to 1 and sets next_asid to max_asid + 1 on every CPU online event, including hotplug cycles. Because next_asid starts beyond the pool boundary, the first call to new_asid() after an online event always wraps the pool, incrementing asid_generation to 2 and assigning ASIDs starting from min_asid. Consider two vCPUs from different VMs, vCPU-A pinned to CPU-X holding asid_generation=2 and ASID=N from before the hotplug event: 1. CPU-X goes offline and back online: asid_generation resets to 1, next_asid = max_asid + 1. 2. One or more vCPUs migrate to CPU-X and call new_asid(), wrapping the pool and consuming ASIDs starting from min_asid. Eventually vCPU-B from a different VM is assigned asid_generation=2, ASID=N — the same ASID that vCPU-A held before the hotplug. 3. vCPU-A enters pre_svm_run() on CPU-X: current_vmcb->cpu is unchanged so the migration branch is skipped. Its saved asid_generation=2 matches sd->asid_generation=2, so the generation check silently passes and vCPU-A continues running with ASID=N — the same ASID just freshly assigned to vCPU-B. Both vCPUs from different VMs now run on CPU-X with the same ASID, causing them to share NPT TLB entries and producing stale translations. The collision manifests as a KVM internal error (Suberror: 1, emulation failure). The NPT page fault reports a faulting GPA far outside the VM's physical memory range — a sign of stale TLB translations being used. KVM falls back to instruction emulation, which fails on FPU/XSave instructions (XRSTOR, STMXCSR) that the emulator does not implement. Fix this by incrementing asid_generation instead of resetting it to 1 in svm_enable_virtualization_cpu(). On module load, asid_generation starts at 0 (memset) and the increment produces 1, identical to the old behaviour. On subsequent hotplug cycles the generation advances beyond any value a vCPU previously observed on this CPU, so the generation check in pre_svm_run() reliably forces new_asid() on every vCPU after every hotplug cycle.

References

NVD — CVE-2026-68093 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-68093
git.kernel.org/stable/c/0f33b1c457... WEB
https://git.kernel.org/stable/c/0f33b1c457c2199ed130b92cc2ff363a3f7b9415
git.kernel.org/stable/c/2028b81321... WEB
https://git.kernel.org/stable/c/2028b81321dc757b6875b99c10d908e349c141e2
git.kernel.org/stable/c/25f744ffa0... WEB
https://git.kernel.org/stable/c/25f744ffa0c8e799e06250ce2e618367b166b0d4
git.kernel.org/stable/c/60283726f2... WEB
https://git.kernel.org/stable/c/60283726f2845bd78b95efbd0e50b93944780477
git.kernel.org/stable/c/6b542d116a... WEB
https://git.kernel.org/stable/c/6b542d116acecb83a1ca34e8eace304cff6a4ec9
git.kernel.org/stable/c/7508916b4b... WEB
https://git.kernel.org/stable/c/7508916b4b55d6f5ecc68cd09774dabd3a6b4440

Frequently Asked Questions

What is CVE-2026-68093?
CVE-2026-68093 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-68093?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-68093?
CVE-2026-68093 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-68093?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-99gx-mqgq-5pqg",
  "modified" : "2026-08-19T18:32:04Z",
  "published" : "2026-08-10T15:33:35Z",
  "aliases" : [ "CVE-2026-68093" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug\n\nIf a vCPU stays scheduled out (or blocked) while the last pCPU it ran\non goes through a hotplug cycle (online->offline->online), and the vCPU\nthen resumes execution on the same pCPU, then it is possible for it to\nrun with an ASID that has now been assigned to a different vCPU,\nresulting in stale TLB translations being used.\n\nsvm_enable_virtualization_cpu() resets asid_generation to 1 and sets\nnext_asid to max_asid + 1 on every CPU online event, including hotplug\ncycles.  Because next_asid starts beyond the pool boundary, the first\ncall to new_asid() after an online event always wraps the pool,\nincrementing asid_generation to 2 and assigning ASIDs starting from\nmin_asid.\n\nConsider two vCPUs from different VMs, vCPU-A pinned to CPU-X holding\nasid_generation=2 and ASID=N from before the hotplug event:\n\n  1. CPU-X goes offline and back online: asid_generation resets to 1,\n     next_asid = max_asid + 1.\n\n  2. One or more vCPUs migrate to CPU-X and call new_asid(), wrapping\n     the pool and consuming ASIDs starting from min_asid.  Eventually\n     vCPU-B from a different VM is assigned asid_generation=2, ASID=N\n     — the same ASID that vCPU-A held before the hotplug.\n\n  3. vCPU-A enters pre_svm_run() on CPU-X: current_vmcb->cpu is\n     unchanged so the migration branch is skipped.  Its saved\n     asid_generation=2 matches sd->asid_generation=2, so the generation\n     check silently passes and vCPU-A continues running with ASID=N —\n     the same ASID just freshly assigned to vCPU-B.\n\nBoth vCPUs from different VMs now run on CPU-X with the same ASID,\ncausing them to share NPT TLB entries and producing stale translations.\n\nThe collision manifests as a KVM internal error (Suberror: 1, emulation\nfailure).  The NPT page fault reports a faulting GPA far outside the\nVM's physical memory range — a sign of stale TLB translations being\nused.  KVM falls back to instruction emulation, which fails on\nFPU/XSave instructions (XRSTOR, STMXCSR) that the emulator does not\nimplement.\n\nFix this by incrementing asid_generation instead of resetting it to 1\nin svm_enable_virtualization_cpu().  On module load, asid_generation\nstarts at 0 (memset) and the increment produces 1, identical to the\nold behaviour.  On subsequent hotplug cycles the generation advances\nbeyond any value a vCPU previously observed on this CPU, so the\ngeneration check in pre_svm_run() reliably forces new_asid() on every\nvCPU after every hotplug cycle.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-68093"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/0f33b1c457c2199ed130b92cc2ff363a3f7b9415"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2028b81321dc757b6875b99c10d908e349c141e2"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/25f744ffa0c8e799e06250ce2e618367b166b0d4"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/60283726f2845bd78b95efbd0e50b93944780477"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6b542d116acecb83a1ca34e8eace304cff6a4ec9"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/7508916b4b55d6f5ecc68cd09774dabd3a6b4440"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-10T13:19:53Z"
  }
}