Is CVE-2026-43133 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-43133 being exploited in the wild.

How severe is CVE-2026-43133?

High severity, with a CVSS score of 7.9, published 6 May 2026.

Which products and versions are affected?

Linux Kernel cc3ed80ae69f to 127ccae2c185f62e6ecb4bf24f9cb307e9b9c619.

Is there a fix for CVE-2026-43133?

A patch was published on 2026-01-14: Initial fix in mainline kernel tree Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-43133 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-43133?

Check whether you run Linux Kernel, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-43133: Linux Kernel KVM incorrect state handling in nSVM VMLOAD/VMSAVE emulation

CVE-2026-43133 · Severity: high · CVSS 7.9 · Published 2026-05-06

A vulnerability in the Linux kernel's virtualization component (KVM) could allow a guest virtual machine to interfere with the host or other virtual environments. Specifically, when using nested virtualization on AMD processors, the system may incorrectly handle certain memory state operations. This could lead to system instability, data corruption, or a complete service outage of the host server.

Technologies: Linux Kernel, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4. Vendors: Linux, Red Hat.

Quick answers

Is CVE-2026-43133 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-43133 being exploited in the wild.
How severe is CVE-2026-43133?: High severity, with a CVSS score of 7.9, published 6 May 2026.
Which products and versions are affected?: Linux Kernel cc3ed80ae69f to 127ccae2c185f62e6ecb4bf24f9cb307e9b9c619.
Is there a fix for CVE-2026-43133?: A patch was published on 2026-01-14: Initial fix in mainline kernel tree Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43133 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-43133?: Check whether you run Linux Kernel, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A logic error in the Linux kernel's KVM nSVM implementation fails to consistently use the primary Virtual Machine Control Block (vmcb01) during VMLOAD/VMSAVE emulation. While a previous commit intended to standardize on vmcb01 for guest state, the emulation path was not updated. If an L2 guest executes these instructions and they are not intercepted by the L1 hypervisor, KVM mistakenly operates on vmcb02. This can result in incorrect guest state being loaded or saved, leading to potential privilege escalation from guest to host or denial of service. The fix ensures that emulation always targets vmcb01 as intended.

Affected products

Linux Linux Kernel cc3ed80ae69f to 127ccae2c185f62e6ecb4bf24f9cb307e9b9c619
Red Hat Red Hat Enterprise Linux 8
Red Hat Red Hat Enterprise Linux 9
Red Hat Red Hat Enterprise Linux 10
Red Hat Red Hat OpenShift Container Platform 4

Timeline

2026-05-06: disclosed
2026-01-14: patched: Initial fix in mainline kernel tree
2026-05-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.