CVE-2026-98714

The Linux kernel contains a vulnerability in the KVM module related to SVM (AMD-V). The issue arises because control fields in the Virtual Machine Control Structure (VMCS) were being updated during a #VMEXIT even if the VMRUN instruction had failed. To ensure architectural consistency, the kernel...

CVE-2026-98714 KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update control fields on VMEXIT if and only if VMRUN succeeded Leave control.erapctl and control.clean as-is in the VMCS if VMRUN fails, because as per AMD: there's no explicit architectural guarantee about the behavior...

PT-2026-116933

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM SVM component where control fields are updated on VMEXIT regardless of whether VMRUN succeeded. Specifically, the control.erap ctl and control.clean fields in...

CVE-2026-98715: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Preserve TLB control i.e. pending TLB flush on failed VMRUN Don't reset the VMCB's TLB control back to "do nothing" on a failed VMRUN, as empirical testing shows that the CPU performs the requested TLB flush if and only...

CVE-2026-98714: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update control fields on VMEXIT if and only if VMRUN succeeded Leave control.erapctl and control.clean as-is in the VMCS if VMRUN fails, because as per AMD: there's no explicit architectural guarantee about the behavior...

PT-2026-116934

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM SVM module where the Translation Lookaside Buffer TLB control is reset to a do nothing state upon a failed VMRUN. Because the CPU only performs the requested T...

Linux Distros Unpatched Vulnerability : CVE-2026-98715

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: SVM: Preserve TLB control i.e. pending TLB flush on failed VMRUN Don't reset the VMCB's TLB control back to do nothing on a failed VMRUN, as empirical...

Linux Distros Unpatched Vulnerability : CVE-2026-98714

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: SVM: Update control fields on VMEXIT if and only if VMRUN succeeded Leave control.erapctl and control.clean as-is in the VMCS if VMRUN fails, because as pe...

Linux Kernel Security Vulnerabilities

Versions of the Linux kernel prior to 7.2.10 have a security vulnerability. This vulnerability stems from improper handling of control fields by the KVM SVM when VMRUN fails, which may result in the operation requested for the control field not being executed...

AZL-88685 CVE-2026-46059 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN For guests with NRIPS disabled, L1 does not provide NextRIP when running an L2 with an injected soft interrupt, instead it advances the current RIP before...

CVE-2026-46014

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Add missing save/restore handling of LBR MSRs MSRIA32DEBUGCTLMSR and LBR MSRs are currently not enumerated by KVMGETMSRINDEXLIST, and LBR MSRs cannot be set with KVMSETMSRS. So save/restore is completely broken. Fix it ...

CVE-2026-45987

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 After VMRUN in guest mode, nestedsynccontrolfromvmcb02 syncs fields written by the CPU from vmcb02 to the cached vmcb12. This is because the cached vmcb12 is use...

UBUNTU-CVE-2026-45987

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 After VMRUN in guest mode, nestedsynccontrolfromvmcb02 syncs fields written by the CPU from vmcb02 to the cached vmcb12. This is because the cached vmcb12 is use...

CVE-2026-46059 KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN For guests with NRIPS disabled, L1 does not provide NextRIP when running an L2 with an injected soft interrupt, instead it advances the current RIP before...

Linux Distros Unpatched Vulnerability : CVE-2026-46059

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN For guests with NRIPS disabled, L1 does not provide NextRIP when running an L2 with an...

EUVD-2011-1140

Malware in sbrugna...

CVE-2024-50115

CVE-2024-50115 is a Linux kernel vulnerability affecting KVM nSVM where loading PDPTEs from memory incorrectly handles nCR3[4:0]. The issue can cause an out-of-bounds read if a target page is at the end of a memslot, due to not enforcing 32-byte alignment when PAE paging is used. The root cause i...

CVE-2024-50115 KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Ignore nCR34:0 when loading PDPTEs from memory Ignore nCR34:0 when loading PDPTEs from memory for nested SVM, as bits 4:0 of CR3 are ignored when PAE paging is used, and thus VMRUN doesn't enforce 32-byte alignment of...

CVE-2024-50115 KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Ignore nCR34:0 when loading PDPTEs from memory Ignore nCR34:0 when loading PDPTEs from memory for nested SVM, as bits 4:0 of CR3 are ignored when PAE paging is used, and thus VMRUN doesn't enforce 32-byte alignment of...

kernel: KVM: double fetch in nested_svm_vmrun can lead to unrestricted MSR access

A flaw was found in the Linux kernel. A KVM guest on AMD can launch a nested guest without the Intercept VMRUN control bit by exploiting a TOCTOU vulnerability in nestedsvmvmrun. A malicious guest could use this flaw to gain unrestricted access to host MSRs, possibly leading to guest-to-host esca...