Executive brief
A vulnerability in the Linux kernel's virtualization component (KVM) could allow a guest operating system to cause a system crash or instability on the host server. This occurs when the system fails to properly handle errors during a transition from a virtual machine back to the host. An exploit could lead to a denial-of-service condition, impacting the availability of the host and all other virtual machines running on it.
Technical details
A vulnerability exists in the Linux kernel KVM nSVM (Nested Secure Virtual Machine) implementation. When a nested #VMEXIT occurs and the restoration of the L1 host's CR3 register fails, the `nested_svm_vmexit()` function returns an error code that is ignored by most callers. This results in the system attempting to continue execution with corrupted state. The fix modifies the behavior to inject a triple fault and trigger a shutdown, which aligns with hardware specifications (AMD APM) for illegal host states, preventing further execution with corrupted memory management structures. This is primarily a local denial-of-service vector for attackers with control over a nested guest.
Affected products
- Linux Linux Kernel All versions prior to the fix in 2026-03-04
Timeline
- 2026-03-04: patched: Fix committed to mainline kernel by Sean Christopherson.
- 2026-05-27: advisory: CVE-2026-46032 published.