{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-43315 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-43315 is a medium-severity denial of service vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-43315 and fix it if it is affected.\n\nWhat it is: CVE-2026-43315 is a medium-severity denial of service vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-43315 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-43315/ (Markdown: https://insights.sbomify.com/CVE-2026-43315/index.md)","id":"CVE-2026-43315","markdown":"https://insights.sbomify.com/CVE-2026-43315/index.md","name":"CVE-2026-43315","record":{"aliases":["BELL-CVE-2026-43315","DEBIAN-CVE-2026-43315","GHSA-fmhq-qfjw-fm2x","ROOT-OS-UBUNTU-2204-CVE-2026-43315","ROOT-OS-UBUNTU-2404-CVE-2026-43315","UBUNTU-CVE-2026-43315"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel KVM","requires_auth":"low_privilege","summary":"A local user can trigger a kernel warning in KVM nested SVM by manipulating CPUID, potentially causing a denial of service.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding\n\nDrop the WARN in svm_set_nested_state() on nested_svm_load_cr3() failing\nas it is trivially easy to trigger from userspace by modifying CPUID after\nloading CR3.  E.g. modifying the state restoration selftest like so:\n\n  --- tools/testing/selftests/kvm/x86/state_test.c\n  +++ tools/testing/selftests/kvm/x86/state_test.c\n  @@ -280,7 +280,16 @@ int main(int argc, char *argv[])\n\n                 /* Restore state in a new VM.  */\n                  vcpu = vm_recreate_with_one_vcpu(vm);\n  -               vcpu_load_state(vcpu, state);\n  +\n  +               if (stage == 4) {\n  +                       state-\u003esregs.cr3 = BIT(44);\n  +                       vcpu_load_state(vcpu, state);\n  +\n  +                       vcpu_set_cpuid_property(vcpu, X86_PROPERTY_MAX_PHY_ADDR, 36);\n  +                       __vcpu_nested_state_set(vcpu, \u0026state-\u003enested);\n  +               } else {\n  +                       vcpu_load_state(vcpu, state);\n  +               }\n\n                  /*\n                   * Restore XSAVE state in a dummy vCPU, first without doing\n\ngenerates:\n\n  WARNING: CPU: 30 PID: 938 at arch/x86/kvm/svm/nested.c:1877 svm_set_nested_state+0x34a/0x360 [kvm_amd]\n  Modules linked in: kvm_amd kvm irqbypass [last unloaded: kvm]\n  CPU: 30 UID: 1000 PID: 938 Comm: state_test Tainted: G        W           6.18.0-rc7-58e10b63777d-next-vm\n  Tainted: [W]=WARN\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  RIP: 0010:svm_set_nested_state+0x34a/0x360 [kvm_amd]\n  Call Trace:\n   \u003cTASK\u003e\n   kvm_arch_vcpu_ioctl+0xf33/0x1700 [kvm]\n   kvm_vcpu_ioctl+0x4e6/0x8f0 [kvm]\n   __x64_sys_ioctl+0x8f/0xd0\n   do_syscall_64+0x61/0xad0\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nSimply delete the WARN instead of trying to prevent userspace from shoving\n\"illegal\" state into CR3.  For better or worse, KVM's ABI allows userspace\nto set CPUID after SREGS, and vice versa, and KVM is very permissive when\nit comes to guest CPUID.  I.e. attempting to enforce the virtual CPU model\nwhen setting CPUID could break userspace.  Given that the WARN doesn't\nprovide any meaningful protection for KVM or benefit for userspace, simply\ndrop it even though the odds of breaking userspace are minuscule.\n\nOpportunistically delete a spurious newline.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding","id":"CVE-2026-43315","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":7,"next":{"headline":"media: solo6x10: Check for out of bounds chip_id","id":"CVE-2026-43316"},"packages":[],"prev":{"headline":"dm: remove fake timeout to avoid leak request","id":"CVE-2026-43314"},"products":["Linux"],"published":"2026-05-08","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A local user can trigger a kernel warning in KVM nested SVM by manipulating CPUID, potentially causing a denial of service.","url":"https://insights.sbomify.com/CVE-2026-43315/"}