CVE-2026-46071 KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12
A logic error in KVM nested SVM handling incorrectly modifies guest VMCB state, potentially causing undefined behavior in virtualized environments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46071?
CVE-2026-46071 is a medium-severity vulnerability in Linux kernel, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12
svm_copy_lbrs() always marks VMCB_LBR dirty in the destination VMCB. However, nested_svm_vmexit() uses it to copy LBRs to vmcb12, and clearing clean bits in vmcb12 is not architecturally defined.
Move vmcb_mark_dirty() to callers and drop it for vmcb12.
This also facilitates incoming refactoring that does not pass the entire VMCB to svm_copy_lbrs().
Which versions are affected by CVE-2026-46071?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46071?
Apply the vendor's patch.
Is CVE-2026-46071 being exploited?
There is no known exploitation of CVE-2026-46071 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-88682, BELL-CVE-2026-46071, DEBIAN-CVE-2026-46071, GHSA-h9fc-vq2v-qf62, ROOT-OS-DEBIAN-12-CVE-2026-46071, ROOT-OS-DEBIAN-13-CVE-2026-46071 and 2 more.