Linux kernel KVM: DEBUGCTL and LBR MSRs missing from save/restore, guest branch state lost

CVSS 5.5CVE-2026-46014Kernel, userspace & hypervisorcurated

Impact

MSR_IA32_DEBUGCTLMSR and the LBR MSRs were not enumerated by KVM_GET_MSR_INDEX_LIST and the LBR MSRs could not be written through KVM_SET_MSRS, so save and restore of that state was simply broken - on AMD for LBRs and DEBUGCTL, on Intel for DEBUGCTL. A guest that is saved and restored, or live-migrated, comes back with incorrect debug/branch-record state, and L1's LBRs were not correctly restored while an L2 was running. For an operator this is a correctness problem in VM migration on hosts where LBR virtualization is enabled: guests relying on branch records for profiling get wrong data after migration, and restored state does not match what was saved. The record describes no privilege escalation or host memory-safety consequence.

Who can reach it

Local, host-side. Requires the ability to drive KVM's MSR save/restore ioctls - the VMM process, not a tenant inside the guest. Only relevant where LBR virtualization is enabled.

What to do

Update the host kernel to a stable release carrying the fix (MSRs added to msrs_to_save_base, userspace-only LBR writes gated on lbrv, LBRs copied from the captured VMCB01 save area in svm_copy_vmrun_state) and reboot each hypervisor node. No mitigation other than avoiding reliance on migrated LBR/DEBUGCTL state on unpatched hosts.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-46014 https://git.kernel.org/stable/c/13a89ada5dcfc2539514c83ba5a2c61157f1ec6c https://git.kernel.org/stable/c/3700f0788da6acf73b2df56690f4b201aa4aefd2 https://git.kernel.org/stable/c/bca0597272f9712b1f8ebd38b184db1dc2902ff7

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.