SB2026052801 - Improper access control in Linux kernel kvm svm

Description

This security bulletin contains information about 1 vulnerability.

1) Improper access control (CVE-ID: CVE-2026-46076)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to bypass hypercall interception controls.

The vulnerability exists due to improper access control in KVM nested SVM handling when processing VMMCALL from an L2 guest. A remote user can invoke an unhandled VMMCALL to bypass hypercall interception controls.

Exploitation requires an active nested virtualization scenario where L2 is running, L1 does not intercept VMMCALL, nested_svm_l2_tlb_flush_enabled() is true, and the hypercall is not one of the supported Hyper-V hypercalls.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/009c0f726abeaa67aad1d96b883bdce01d405ce2
• https://git.kernel.org/stable/c/5fb4a5f361565f5b629d8a8fe5288ce8463c5727
• https://git.kernel.org/stable/c/924d721fae95687acedbaf624a094ed0e8b67104
• https://git.kernel.org/stable/c/c36991c6f8d2ab56ee67aff04e3c357f45cfc76c