SB2026052820 - Improper control of a resource through its lifetime in Linux kernel kvm svm

Description

This security bulletin contains information about 1 vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-46059)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in KVM nSVM nested virtualization handling when processing save and restore of an L2 guest after the first nested VMRUN. A local user can trigger a nested guest state transition to cause a denial of service.

The issue occurs for guests with NRIPS disabled.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3428ed1529a1af4cce5aff6c5bd2fcc39ad726bb
• https://git.kernel.org/stable/c/69fe1411a5ce678b4da6489b5d2282b4e1d13acf
• https://git.kernel.org/stable/c/8d397582f6b5e9fbcf09781c7c934b4910e94a50