PatchSiren cyber security CVE debrief

CVE-2026-46082 Linux CVE debrief

## Summary CVE-2026-46082 is a vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) SVM (Secure Virtual Machine) module. The issue involves the INVLPGA instruction not properly injecting an undefined opcode (#UD) exception when the EFER.SVME (Secure Virtual Machine Enable) bit is not set. According to AMD architecture specifications, INVLPGA should cause a #UD when SVM is not enabled. The vulnerability was resolved by adding a check to properly inject #UD when EFER.SVME=0. ## Technical Details The vulnerability exists in the KVM SVM implementation where the INVLPGA (Invalidate TLB Entry in a Specified ASID) instruction handler did not verify whether SVM was enabled via EFER.SVME before executing. When a guest VM executes INVLPGA without SVM enabled, the hardware expects a #UD exception, but the kernel was not properly injecting this exception. This could lead to unexpected behavior or potential security implications in virtualized environments. The fix adds a check to ensure that when EFER.SVME is not set, the KVM module properly injects a #UD exception for INVLPGA instructions, aligning the software behavior with hardware expectations and AMD architectural specifications. ## Affected Versions The vulnerability affects Linux kernel versions with KVM SVM support. Based on the stable kernel commits referenced, patches have been applied to multiple stable branches. The commits indicate backports to various stable kernel versions. ## Impact Without the fix, a guest virtual machine could execute INVLPGA instructions in a state where SVM is not enabled, potentially leading to: - Unexpected execution flow in the guest - Possible information disclosure or denial of service conditions - Violation of expected architectural behavior The vulnerability is particularly relevant for AMD-based virtualization environments using KVM. ## Detection Organizations running KVM on AMD hardware should verify their kernel versions against the patched versions. The vulnerability would manifest in virtualized environments where guests might attempt to execute INVLPGA instructions. ## Remediation Apply the appropriate kernel patch from the stable kernel tree.