CVE-2026-46071: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12
In the Linux kernel, the following vulnerability has been resolved:
KVM: nSVM: Avoid clearing VMCBLBR in vmcb12
svmcopylbrs() always marks VMCBLBR dirty in the destination VMCB. However, nestedsvmvmexit() uses it to copy LBRs to vmcb12, and clearing clean bits in vmcb12 is not architecturally defined.
Move vmcbmarkdirty() to callers and drop it for vmcb12.
This also facilitates incoming refactoring that does not pass the entire VMCB to svmcopylbrs().
Affected Software
Remediation
Event History
Frequently Asked Questions
What systems are exposed to this issue?
The issue affects Linux kernel systems using KVM nested SVM functionality. Exploitation requires local access with low privileges, according to the CVSS vector.
What is the impact if exploited?
The reported impact is availability only: a local low-privileged attacker may cause a high availability impact. No confidentiality or integrity impact is indicated.
Is a patch available?
Yes. A patch is available, with fixes referenced in the listed Linux stable kernel commits.