CVE-2026-46076KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 Explicitly synthesize a #UD for VMMCALL if L2 is active, L1 does NOT want to intercept VMMCALL, nested_svm_l2_tlb_flush_enabled() is true, and the hypercall is something other than one of the supported Hyper-V hypercalls. When all of the above conditions are met, KVM will intercept VMMCALL but never forward it to L1, i.e. will let L2 make hypercalls as if it were L1. The TLFS says a whole lot of nothing about this scenario, so go with the architectural behavior, which says that VMMCALL #UDs if it's not intercepted. Opportunistically do a 2-for-1 stub trade by stub-ifying the new API instead of the helpers it uses. The last remaining "single" stub will soon be dropped as well. [sean: rewrite changelog and comment, tag for stable, remove defunct stubs]
- CVSS
- 7.9 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Undergoing Analysis
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 3f4a812edf5cb0a50e65fbdfafdb3e688da18f16 before 924d721fae95687acedbaf624a094ed0e8b67104; from 3f4a812edf5cb0a50e65fbdfafdb3e688da18f16 before 009c0f726abeaa67aad1d96b883bdce01d405ce2; from 3f4a812edf5cb0a50e65fbdfafdb3e688da18f16 before 5fb4a5f361565f5b629d8a8fe5288ce8463c5727; from 3f4a812edf5cb0a50e65fbdfafdb3e688da18f16 before c36991c6f8d2ab56ee67aff04e3c357f45cfc76c | CNA record |
linux linux_kernel linux:linux_kernel | from 6.2 before 6.12.86; from 6.13 before 6.18.27; from 6.19 before 7.0.4 | NVD |
References
- https://git.kernel.org/stable/c/924d721fae95687acedbaf624a094ed0e8b67104patch
- https://git.kernel.org/stable/c/009c0f726abeaa67aad1d96b883bdce01d405ce2patch
- https://git.kernel.org/stable/c/5fb4a5f361565f5b629d8a8fe5288ce8463c5727patch
- https://git.kernel.org/stable/c/c36991c6f8d2ab56ee67aff04e3c357f45cfc76cpatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.