PatchSiren cyber security CVE debrief

CVE-2026-46131 Linux CVE debrief

A logic error in KVM x86 nested virtualization flush hypercalls could lead to invalid memory translations when nested EPT/NPT is disabled. The vulnerability stems from an incorrect condition check: `is_guest_mode(vcpu)` was used to determine whether to call `translate_nested_gpa()`, but this function is only valid when an L2 guest is running with nested EPT/NPT enabled. The fix aligns the condition with `translate_nested_gpa()`'s own validation logic. This affects Linux kernel KVM implementations supporting nested virtualization. The vulnerability was resolved in the Linux kernel stable branches with commits dated May 28, 2026. No CVSS score or severity has been assigned by NVD as of the CVE publication date.

Vendor: Linux
Product: Unknown
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-28
Original CVE updated: 2026-06-24
Advisory published: 2026-05-28
Advisory updated: 2026-06-24

Who should care

Organizations running Linux-based hypervisors with KVM nested virtualization enabled, particularly those hosting multi-tenant workloads or untrusted nested guests. Cloud providers and enterprises using nested virtualization for testing, development, or container-in-VM deployments should prioritize patching.

Technical summary

The KVM x86 implementation incorrectly used `is_guest_mode(vcpu)` to guard calls to `translate_nested_gpa()` in slow flush hypercall paths. This condition is insufficient because `translate_nested_gpa()` requires nested EPT/NPT to be enabled, not merely that the vCPU is in guest mode. When an L2 guest runs without nested EPT/NPT, the incorrect condition could lead to invalid GPA translations. The fix replaces the condition with the same check used internally by `translate_nested_gpa()`, ensuring the translation function is only invoked when its preconditions are satisfied.

Defensive priority

medium

Recommended defensive actions

Apply the relevant stable kernel patch for your kernel version (commits referenced in CVE record)
Verify nested virtualization configurations use properly patched KVM modules
Monitor NVD for CVSS scoring once analysis is complete
Review hypervisor logs for any anomalous nested guest behavior if running unpatched kernels with nested virtualization enabled

Evidence notes

CVE description confirms the vulnerability is resolved in Linux kernel KVM x86 code. Five stable kernel commits are referenced, indicating backports to multiple kernel versions. NVD status is 'Awaiting Analysis' with no CVSS vector or weaknesses assigned. No KEV listing or known ransomware campaign use is indicated.

Sources and references

Verified primary and authoritative sources

CVE-2026-46131 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-46131

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-46131 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46131

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/45fc766bc756ff1d66f8ca026a9c4f7f764adfae

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/464af6fc2b1dcc74005b7f58ee3812b17777efee

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/4c7f8436b19a2a3acc0cb6b6e3becd6796ae5c57

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/971f17f5d91045404e3914029ea57c3da90179a4

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/d6f4e217d663ede5becc2fd6cb612c749677387b

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.