Improper control of a resource through its lifetime in Linux kernel - CVE-2026-46014

Vulnerability identifier: #VU132478

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-46014

CWE-ID: CWE-664

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to disrupt virtual machine state handling.

The vulnerability exists due to improper state management in KVM SVM LBR MSR save and restore handling when processing userspace MSR save and restore operations. A local user can trigger incorrect handling of LBR and debug control MSRs to disrupt virtual machine state handling.

Exploitation requires access to userspace interfaces that manage virtual CPU MSR state, and LBR-related behavior depends on LBR virtualization being enabled.

Linux kernel
openEuler
Ubuntu
python3-perf-debuginfo
python3-perf
perf-debuginfo
perf
kernel-tools-devel
kernel-tools-debuginfo
kernel-tools
kernel-source
kernel-headers
kernel-devel
kernel-debugsource
kernel-debuginfo
bpftool-debuginfo
bpftool
kernel
kernel-extra-modules
linux (Ubuntu package)
linux-azure (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-raspi (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
python3-perf-debuginfo - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.17.150
python3-perf - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.17.150
perf-debuginfo - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.17.150
perf - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.17.150
kernel-tools-devel - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.17.150
kernel-tools-debuginfo - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.17.150
kernel-tools - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.17.150
kernel-source - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.17.150
kernel-headers - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.17.150
kernel-devel - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.17.150
kernel-debugsource - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.17.150
kernel-debuginfo - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.17.150
bpftool-debuginfo - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.17.150
bpftool - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.17.150
kernel - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.17.150
kernel-extra-modules - update to 6.6.0-145.3.17.150
linux (Ubuntu package) - update to 7.0.0-27.27
linux-azure (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1010.10
linux-nvidia (Ubuntu package) - update to 7.0.0-1013.13
linux-raspi (Ubuntu package) - update to 7.0.0-1014.14

• https://git.kernel.org/stable/c/13a89ada5dcfc2539514c83ba5a2c61157f1ec6c
• https://git.kernel.org/stable/c/2b922a42b531a82d7881add14a7698dcdc5e1f0a
• https://git.kernel.org/stable/c/3700f0788da6acf73b2df56690f4b201aa4aefd2

• Improper control of a resource through its lifetime in Linux kernel x86 kvm
• Ubuntu update for linux
• Ubuntu update for linux-raspi
• openEuler 24.03 LTS SP3 update for kernel
• Ubuntu update for linux-nvidia
• Ubuntu update for linux-azure
• openEuler 24.03 LTS SP1 update for kernel