KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
CVE-2026-46076 · published 27 May 2026
How serious is it
- Severity: high, CVSS score 7.9 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-46076?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: 3f4a812edf5cb0a50e65fbdfafdb3e688da18f16 to < fcef67506c0234935cb0fb026740a637edb58d7c, 3f4a812edf5cb0a50e65fbdfafdb3e688da18f16 to < 924d721fae95687acedbaf624a094ed0e8b67104, 3f4a812edf5cb0a50e65fbdfafdb3e688da18f16 to < 009c0f726abeaa67aad1d96b883bdce01d405ce2, 3f4a812edf5cb0a50e65fbdfafdb3e688da18f16 to < 5fb4a5f361565f5b629d8a8fe5288ce8463c5727
- Linux Linux: 6.2
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
Explicitly synthesize a #UD for VMMCALL if L2 is active, L1 does NOT want
to intercept VMMCALL, nested_svm_l2_tlb_flush_enabled() is true, and the
hypercall is something other than one of the supported Hyper-V hypercalls.
When all of the above conditions are met, KVM will intercept VMMCALL but
never forward it to L1, i.e. will let L2 make hypercalls as if it were L1.
The TLFS says a whole lot of nothing about this scenario, so go with the
architectural behavior, which says that VMMCALL #UDs if it's not
intercepted.
Opportunistically do a 2-for-1 stub trade by stub-ifying the new API
instead of the helpers it uses. The last remaining "single" stub will
soon be dropped as well.
[sean: rewrite changelog and comment, tag for stable, remove defunct stubs]
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/fcef67506c0234935cb0fb026740a637edb58d7c
- git.kernel.org/stable/c/924d721fae95687acedbaf624a094ed0e8b67104
- git.kernel.org/stable/c/009c0f726abeaa67aad1d96b883bdce01d405ce2
- git.kernel.org/stable/c/5fb4a5f361565f5b629d8a8fe5288ce8463c5727
- git.kernel.org/stable/c/c36991c6f8d2ab56ee67aff04e3c357f45cfc76c
Merged from CVE List. Last updated 25 Oct 2026. All vulnerabilities · RSS · JSON