CVE-2026-46082

A flaw was found in the Linux kernel's virtualization component, known as KVM. This vulnerability arises when a specific instruction, INVLPGA, is used in a virtualized environment without the proper security setting (EFER.SVME). The system fails to trigger an expected error, which could allow a local attacker to bypass security controls or disrupt the system's operation, leading to a denial of service.

This vulnerability is rated as Moderate severity because exploitation requires local execution within virtualized guests running on AMD-based hardware, primarily resulting in a denial of service rather than host compromise or data exfiltration. Red Hat Enterprise Linux systems are only exposed when actively hosting virtual machines using the KVM AMD hypervisor module. Systems utilizing Intel processors or configurations where hardware virtualization is not enabled remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.