Linux kernel KVM nSVM: wrong NextRIP used in vmcb02 after the first L2 VMRUN

CVSS 5.5CVE-2026-46059Kernel, userspace & hypervisorcurated

Impact

When L1 runs with NRIPS disabled, KVM emulates a CPU without NRIPS by using the current RIP as vmcb02's NextRIP for injected soft interrupts. After L2 has run once, NextRIP is updated by the CPU or by KVM and the current RIP is no longer the right value, so after a save/restore the nested guest can resume with an incorrect next instruction pointer. The fix uses the current RIP only when a nested run is pending and NextRIP otherwise, with the same treatment for soft_int_next_rip. For an operator the exposure is nested guests on AMD hosts misbehaving after save/restore or live migration; the record does not describe a host escape or memory-safety impact.

Who can reach it

Local, AMD hosts with nested virtualization in use. Requires access to KVM's nested save/restore ioctls from the host VMM process, not from inside a tenant guest.

What to do

Update the host kernel to a stable release containing the fix and reboot each hypervisor node. Interim mitigation is to avoid exposing nested virtualization and avoid nested-guest save/restore on unpatched AMD hosts.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-46059 https://git.kernel.org/stable/c/3428ed1529a1af4cce5aff6c5bd2fcc39ad726bb https://git.kernel.org/stable/c/8d397582f6b5e9fbcf09781c7c934b4910e94a50 https://git.kernel.org/stable/c/b1a45e8a59bcf1f1ec0da6d4e42190b4211c67fc

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.