PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46071 Linux CVE debrief

A vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) nested SVM (Secure Virtual Machine) implementation has been resolved. The issue involved improper handling of VMCB (Virtual Machine Control Block) clean bits during nested VM exits. Specifically, the `svm_copy_lbrs()` function always marked the VMCB_LBR (Last Branch Record) field as dirty in the destination VMCB. When `nested_svm_vmexit()` used this function to copy LBRs to vmcb12 (the guest's VMCB), it would clear clean bits in vmcb12—a behavior that is not architecturally defined by AMD's SVM specification. The fix moves the `vmcb_mark_dirty()` call to the appropriate callers and removes it for vmcb12 operations, ensuring architectural compliance and preventing potential state corruption during nested virtualization transitions.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Organizations running Linux-based virtualization infrastructure with AMD processors and nested virtualization enabled; cloud providers offering nested virtualization capabilities; security teams managing kernel patch cycles for hypervisor hosts

Technical summary

The vulnerability existed in the KVM nSVM (nested SVM) subsystem where `svm_copy_lbrs()` unconditionally marked VMCB_LBR as dirty via `vmcb_mark_dirty()`. When `nested_svm_vmexit()` invoked this function to copy LBR state to vmcb12, the dirty bit marking in the guest VMCB violated architectural specifications—AMD SVM does not define clean bit semantics for vmcb12. The resolution refactors the code to move dirty-bit marking to callers, eliminating the undefined behavior for nested guest VMCBs. This change also enables future refactoring that avoids passing entire VMCB structures to `svm_copy_lbrs()`.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available from your Linux distribution
  • For systems running nested virtualization with AMD SVM, prioritize kernel updates to prevent potential VM state corruption
  • Monitor vendor security advisories for kernel package updates addressing this issue
  • Review nested virtualization configurations and consider disabling nested SVM if not required until patches are applied

Evidence notes

The vulnerability description indicates this was a logic error in nested virtualization state management rather than a memory safety issue. The fix involves code refactoring to properly separate dirty-bit marking between host and guest VMCB contexts. No CVSS score has been assigned as of the CVE publication date.

Official resources

2026-05-27