Executive brief
A vulnerability was identified in the Linux kernel's virtualization component (KVM) for AMD processors. The system failed to properly validate permissions when a virtual machine attempted to use a specific memory management instruction. This could potentially allow a guest virtual machine to cause minor instability or unexpected behavior in the virtualization environment.
Technical details
A vulnerability in the Linux kernel's KVM SVM implementation stems from a missing permission check in the `invlpga_interception` function. The INVLPGA (Invalidate TLB Entry in Guest Address Space) instruction is required by the x86 architecture to trigger an Invalid Opcode (#UD) fault if the SVME (Secure Virtual Machine Enable) bit in the EFER register is not set. Prior to this fix, KVM did not verify this condition, potentially allowing guest software to execute the instruction or trigger an interception without the proper architectural prerequisites. The fix introduces a call to `nested_svm_check_permissions` to ensure the instruction is handled correctly according to the CPU's state.
Affected products
- Linux Linux Kernel All versions implementing INVLPGA prior to the fix
Timeline
- 2026-02-28: other: Patch authored
- 2026-05-27: advisory: NVD published CVE-2026-46082
References
- https://git.kernel.org/stable/c/3ac9d4241d205f5d0df06358349ca718ebb0fa12
- https://git.kernel.org/stable/c/643125b66ffc1147c66616b749475ba9efb15971
- https://git.kernel.org/stable/c/c15392ed9e49c1a16b4d3a3ccf1b3bf2318a6c28
- https://git.kernel.org/stable/c/d99df02ff427f461102230f9c5b90a6c64ee8e23
- https://git.kernel.org/stable/c/ee24928ecd85db4b68ed111e91fef36af0ca37b0