CVE-2026-46059 Details
Description
In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN For guests with NRIPS disabled, L1 does not provide NextRIP when running an L2 with an injected soft interrupt, instead it advances the current RIP before running it. KVM uses the current RIP as the NextRIP in vmcb02 to emulate a CPU without NRIPS. However, after L2 runs the first time, NextRIP will be updated by the CPU and/or KVM, and the current RIP is no longer the correct value to use in vmcb02. Hence, after save/restore, use the current RIP if and only if a nested run is pending, otherwise use NextRIP. Give soft_int_next_rip the same treatment, as it's the same logic, just for a narrower use case. [sean: give soft_int_next_rip the same treatment]
A vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) nested SVM (Secure Virtual Machine) implementation has been addressed. The issue arises for guests with NRIPS (Non-Return Instruction Pointer) disabled, where the hypervisor (L1) fails to provide the NextRIP value when an L2 guest is running with an injected soft interrupt. Instead, it advances the current RIP (Instruction Pointer) before execution. KVM compensates by using the current RIP as the NextRIP in vmcb02, emulating a CPU without NRIPS. However, after the first L2 VMRUN, the CPU and/or KVM updates the NextRIP, making the initial RIP value incorrect for vmcb02. The vulnerability has been fixed by ensuring that, after saving and restoring state, the current RIP is used only when a nested run is pending; otherwise, the NextRIP is utilized. This adjustment also applies to the soft_int_next_rip variable, which serves a similar purpose in a more specific context.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for downloading the patched version are available on the Linux kernel's official website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/3428ed1529a1af4cce5aff6c5bd2fcc39ad726bb | kernel.org | Patch |
| https://git.kernel.org/stable/c/69fe1411a5ce678b4da6489b5d2282b4e1d13acf | kernel.org | Patch |
| https://git.kernel.org/stable/c/8d397582f6b5e9fbcf09781c7c934b4910e94a50 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.8, < 6.18.27 >= 6.19, < 7.0.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 16, 2026 | Initial Analysis | [email protected] |
| May 27, 2026 | New CVE Received | kernel.org |