CVE-2026-43133

Modified Modified - Updated After Analysis

KVM: nSVM VMLOAD/VMSAVE Emulation Uses vmcb01

Publication date: 2026-05-06

Last updated on: 2026-06-30

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation Commit cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload of guest state") made KVM always use vmcb01 for the fields controlled by VMSAVE/VMLOAD, but it missed updating the VMLOAD/VMSAVE emulation code to always use vmcb01. As a result, if VMSAVE/VMLOAD is executed by an L2 guest and is not intercepted by L1, KVM will mistakenly use vmcb02. Always use vmcb01 instead of the current VMCB.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-06

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-05-06

EPSS Evaluated

2026-07-05

NVD

CVE-2026-43133

EUVD

EUVD-2026-27695

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.2 (inc) to 6.6.128 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.75 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.16 (exc)
linux	linux_kernel	From 6.19 (inc) to 6.19.6 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.165 (exc)
linux	linux_kernel	From 5.13 (inc) to 5.15.202 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-628	The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's KVM (Kernel-based Virtual Machine) implementation related to nested virtualization using nSVM. Specifically, the issue involves the VMLOAD and VMSAVE instructions used to save and load the guest state in virtual machines.

A commit intended to fix the handling of these instructions made KVM always use a specific control block (vmcb01) for certain fields, but it failed to update the VMLOAD/VMSAVE emulation code accordingly. As a result, when an L2 guest executes VMSAVE/VMLOAD and the L1 hypervisor does not intercept it, KVM incorrectly uses vmcb02 instead of vmcb01.

This mismatch can cause incorrect handling of the guest state during nested virtualization operations.

Impact Analysis

This vulnerability can lead to incorrect handling of the guest virtual machine state during nested virtualization scenarios. Specifically, if an L2 guest executes VMLOAD/VMSAVE instructions that are not intercepted by the L1 hypervisor, the KVM may use the wrong control block (vmcb02 instead of vmcb01).

This could potentially cause instability, incorrect behavior, or security issues in nested virtual machines, affecting the reliability and security of virtualized environments that rely on nested virtualization.

Hi! I’m here to help you understand CVE-2026-43133. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70