CVE-2026-46076 Linux CVE debrief

Who should care

Organizations running nested virtualization workloads on AMD hardware using KVM, cloud providers offering nested virtualization services, and Linux kernel administrators managing multi-tenant virtualized environments

Technical summary

The vulnerability exists in KVM's nested SVM implementation where VMMCALL instructions from an L2 guest could be executed with L1 privileges under specific conditions. When L1 does not intercept VMMCALL, nested_svm_l2_tlb_flush_enabled() returns true, and the hypercall is not a supported Hyper-V hypercall, KVM would intercept but not forward the call to L1. This breaks the expected virtualization boundary. The resolution synthesizes a #UD exception, which is the architecturally correct behavior for unintercepted VMMCALL instructions. The fix has been backported to multiple stable kernel branches as indicated by four separate commits.

Defensive priority

medium

Recommended defensive actions

• Apply kernel updates from your Linux distribution that include the fix for CVE-2026-46076
• Verify running kernel version is 6.12.29 or later, or contains the backported fix for your stable branch
• If running nested virtualization with KVM and AMD SVM, confirm that VMMCALL interception is properly configured for L1 guests
• Review nested virtualization configurations to ensure L1 guests have appropriate interception controls enabled
• Monitor for kernel security advisories from your distribution regarding this CVE

Evidence notes

The vulnerability description is derived from the official CVE record and NVD source data. The technical details are based on the kernel commit changelog which describes the specific conditions triggering the bug: L2 active, L1 not intercepting VMMCALL, nested_svm_l2_tlb_flush_enabled() true, and non-Hyper-V hypercall. The fix explicitly raises #UD per architectural specification. Multiple stable kernel branches received backports as evidenced by four separate git.kernel.org stable commits.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.