CVE-2026-98716

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for AMD processors (SVM). During nested virtualization, KVM incorrectly checked whether Model-Specific Register (MSR) accesses were intercepted by referencing the wrong control structure's permission bitmap. A malicious guest could exploit this behavior to bypass register interception controls, potentially leading to unauthorized hardware state manipulation or a denial of service (DoS).

This vulnerability is rated as Important because an attacker operating within a nested virtual machine can circumvent register interception boundaries, leading to potential hypervisor compromise or host denial of service. The risk qualifies for this severity rating due to the cross-boundary escape potential from an unprivileged guest into the host kernel environment. Exploitation is strictly constrained to AMD hardware platforms configured to run nested KVM virtualization, meaning Intel-based deployments and hypervisors operating without nested virtualization enabled remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.