CVE-2026-46014: KVM: SVM: Add missing save/restore handling of LBR MSRs
In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: Add missing save/restore handling of LBR MSRs
MSRIA32DEBUGCTLMSR and LBR MSRs are currently not enumerated by KVMGETMSRINDEXLIST, and LBR MSRs cannot be set with KVMSETMSRS. So save/restore is completely broken.
Fix it by adding the MSRs to msrstosavebase, and allowing writes to LBR MSRs from userspace only (as they are read-only MSRs) if LBR virtualization is enabled. Additionally, to correctly restore L1's LBRs while L2 is running, make sure the LBRs are copied from the captured VMCB01 save area in svmcopyvmrunstate().
Note, for VMX, this also fixes a flaw where MSRIA32DEBUGCTLMSR isn't reported as an MSR to save/restore.
Note #2, over-reporting MSRIA32LASTxxx on Intel is ok, as KVM already handles unsupported reads and writes thanks to commit b5e2fec0ebc3 ("KVM: Ignore DEBUGCTL MSRs with no effect") (kvmdomsraccess() will morph the unsupported userspace write into a nop).
[sean: guard with lbrv checks, massage changelog]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-28.28~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-27.27 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1010.10 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-27.27.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-27.27.1
Event History
Frequently Asked Questions
Which virtualization environments are affected by the broken state handling?
The issue affects KVM save/restore handling for AMD SVM LBR MSRs and MSR_IA32_DEBUGCTLMSR. The change also corrects VMX reporting of MSR_IA32_DEBUGCTLMSR as an MSR that must be saved and restored.
When can userspace write LBR MSRs after the fix?
Userspace writes to LBR MSRs are allowed only when LBR virtualization is enabled. The LBR MSRs are otherwise read-only.
How can an operator identify the broken behavior?
On an affected kernel, MSR_IA32_DEBUGCTLMSR and LBR MSRs are not enumerated by KVM_GET_MSR_INDEX_LIST, and LBR MSRs cannot be set through KVM_SET_MSRS. This causes KVM save/restore handling for those registers to be incomplete.