CVE-2026-46076KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
- 7.9HighCVSS base score
- 0.14%Exploitation in 30 daysEPSS · top 97% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 Explicitly synthesize a #UD for VMMCALL if L2 is active, L1 does NOT want to intercept VMMCALL, nested_svm_l2_tlb_flush_enabled() is true, and the hypercall is something other than one of the supported Hyper-V hypercalls. When all of the above conditions are met, KVM will intercept VMMCALL but never forward it to L1, i.e. will let L2 make hypercalls as if it were L1. The TLFS says a whole lot of nothing about this scenario, so go with the architectural behavior, which says that VMMCALL #UDs if it's not intercepted. Opportunistically do a 2-for-1 stub trade by stub-ifying the new API instead of the helpers it uses. The last remaining "single" stub will soon be dropped as well. [sean: rewrite changelog and comment, tag for stable, remove defunct stubs]
Timeline
ID reserved
By Linux
- 14 days later
· 14 days later
Published
- 5 months later
· 5 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.9 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H |
| NVDNVD · Undergoing Analysis | 3.1 | High7.9 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H |
- EPSS (exploitation in 30 days)
- 0.14% · top 97% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.9.
Affected products
- affected 3f4a812edf5cb0a50e65fbdfafdb3e688da18f16 – < fcef67506c0234935cb0fb026740a637edb58d7c
- affected 3f4a812edf5cb0a50e65fbdfafdb3e688da18f16 – < 924d721fae95687acedbaf624a094ed0e8b67104
- affected 3f4a812edf5cb0a50e65fbdfafdb3e688da18f16 – < 009c0f726abeaa67aad1d96b883bdce01d405ce2
- affected 3f4a812edf5cb0a50e65fbdfafdb3e688da18f16 – < 5fb4a5f361565f5b629d8a8fe5288ce8463c5727
- affected 3f4a812edf5cb0a50e65fbdfafdb3e688da18f16 – < c36991c6f8d2ab56ee67aff04e3c357f45cfc76c
- affected 6.2
- unaffected < 6.2
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.86 – ≤ 6.12.*
- unaffected 6.18.27 – ≤ 6.18.*
- unaffected 7.0.4 – ≤ 7.0.*
- unaffected 7.1 – ≤ *
References
References5
- https://git.kernel.org/stable/c/fcef67506c0234935cb0fb026740a637edb58d7c (opens in a new tab)
- https://git.kernel.org/stable/c/924d721fae95687acedbaf624a094ed0e8b67104 (opens in a new tab)
- https://git.kernel.org/stable/c/009c0f726abeaa67aad1d96b883bdce01d405ce2 (opens in a new tab)
- https://git.kernel.org/stable/c/5fb4a5f361565f5b629d8a8fe5288ce8463c5727 (opens in a new tab)
- https://git.kernel.org/stable/c/c36991c6f8d2ab56ee67aff04e3c357f45cfc76c (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-32458 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-46076)Record last updated .