CVE-2026-46082: KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0
In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0
INVLPGA should cause a #UD when EFER.SVME is not set. Add a check to properly inject #UD when EFER.SVME=0.
[sean: tag for stable@]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Upgrade
Upgrade
Linux kernel (KVM: SVM)to a version that resolves this vulnerability.Patch KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0
Event History
Frequently Asked Questions
What access would an attacker need to trigger this issue?
The vector requires local access and low privileges, according to the CVSS data. No user interaction is required.
What is the security impact of successful exploitation?
The reported impact is limited to availability: confidentiality and integrity are marked as unaffected, while availability impact is high.
Which systems are identified as affected?
The listed software includes the Linux kernel and Microsoft azl3 kernel version 6.6.139.1-1. The issue is in KVM's SVM handling of the INVLPGA instruction when EFER.SVME is not set.
Are stable kernel updates relevant for remediation?
Yes. The vulnerability description indicates the fix was tagged for stable kernel maintenance, and the provided references point to stable kernel commits.