CVE-2026-46076

A flaw was found in the Kernel-based Virtual Machine (KVM) nSVM module of the Linux kernel. This vulnerability occurs when an unhandled VMMCALL is not properly intercepted by the Level 1 (L1) hypervisor. A malicious Level 2 (L2) guest operating system could exploit this by making specific hypercalls, leading to an Undefined Opcode exception (#UD) in the host. This could potentially result in a denial of service for the host system.

This vulnerability is rated as Moderate impact because successful exploitation requires an AMD host running KVM with nested virtualization enabled alongside Hyper-V enlightened TLB flushes. Under standard deployments, nested virtualization is either not utilized or restricted to trusted administrative environments. An attacker must already possess execution privileges inside a nested guest to issue unauthorized hypercalls, limiting the blast radius compared to unauthenticated host-level compromises. Environments that do not host untrusted multi-tenant nested virtual machines are not exposed to this risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.