KVM SVM #UD Injection on EFER.SVME=0

Publication date: 2026-05-27

Last updated on: 2026-06-24

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 INVLPGA should cause a #UD when EFER.SVME is not set. Add a check to properly inject #UD when EFER.SVME=0. [sean: tag for stable@]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-24

Generated

2026-07-06

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-46082

EUVD

EUVD-2026-32465

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.7 (inc) to 6.12.86 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.140 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.27 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.4 (exc)
linux	linux_kernel	From 2.6.32 (inc) to 5.15.209 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's KVM (Kernel-based Virtual Machine) component, specifically related to SVM (Secure Virtual Machine) functionality. The issue involves the handling of the INVLPGA instruction, which should trigger a #UD (Undefined Instruction) exception if the EFER.SVME bit is not set. The vulnerability was that this check was missing or incorrect, allowing the instruction to be processed improperly. The fix adds a proper check to inject the #UD exception when EFER.SVME is zero.

Impact Analysis

If exploited, this vulnerability could cause the Linux kernel's virtualization subsystem to behave incorrectly by not properly handling the INVLPGA instruction when the EFER.SVME bit is unset. This could potentially lead to unexpected behavior or instability in virtualized environments using KVM with SVM support.

Hi! I’m here to help you understand CVE-2026-46082. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70