CVE-2026-45987: Linux Kernel Privilege Escalation Flaw

CVE-2026-45987 Overview

CVE-2026-45987 is a Linux kernel vulnerability in the KVM nested SVM (nSVM) virtualization subsystem. The flaw involves improper synchronization of the interrupt shadow state from vmcb02 to the cached vmcb12 after a VMRUN of an L2 guest. When KVM_SET_VCPU_EVENTS is invoked before KVM_SET_NESTED_STATE during state restore, the interrupt shadow is written to vmcb01 rather than vmcb02. For L2 guests, this can cause a vCPU hang if a wakeup interrupt arrives before a HLT instruction that should have been protected by an interrupt shadow.

Critical Impact
Nested L2 guest vCPUs may hang during state restoration, causing denial-of-service conditions in virtualized workloads on AMD SVM hardware.

Affected Products

Linux kernel (KVM subsystem with nested SVM support)
AMD SVM-enabled hypervisor hosts running nested virtualization
Distributions shipping affected stable kernel branches

Discovery Timeline

2026-05-27 - CVE-2026-45987 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45987

Vulnerability Analysis

The vulnerability resides in the nested SVM control synchronization path of the Linux KVM subsystem. After a VMRUN in guest mode, the function nested_sync_control_from_vmcb02() copies CPU-written fields from vmcb02 back to the cached vmcb12. The cached vmcb12 acts as the authoritative source for several control fields and serves as the payload during nested state save and restore operations.

The int_state field, which contains bit 0 (SVM_INTERRUPT_SHADOW_MASK) for nested VMs, is written by the CPU but was not being synchronized back to the cached vmcb12. This omission creates a state divergence between the live VMCB and its cached counterpart.

Root Cause

The root cause is missing synchronization logic in nested_sync_control_from_vmcb02(). The function failed to propagate the int_state field from vmcb02 to the cached vmcb12 after guest execution. When userspace restored nested state via KVM_SET_VCPU_EVENTS followed by KVM_SET_NESTED_STATE, the interrupt shadow bit was applied to the wrong VMCB structure (vmcb01 instead of vmcb02), corrupting L2 execution semantics.

Attack Vector

The issue is triggered through the standard KVM userspace ioctl interface during virtual machine state migration, snapshot restore, or live migration workflows. A privileged userspace process performing nested state restoration in a non-canonical ioctl order causes the L2 vCPU to lose its interrupt shadow protection. For L1 guests, the impact is limited to a delayed interrupt. For L2 guests, the vCPU can hang indefinitely if a wakeup interrupt is delivered before an expected HLT instruction within what should have been an interrupt shadow window.

No verified proof-of-concept code is published for this vulnerability. Refer to the Kernel Git Commit Fixes for the upstream patch implementing the synchronization fix.

Detection Methods for CVE-2026-45987

Indicators of Compromise

Unexplained L2 guest vCPU hangs immediately following VM migration, snapshot restore, or pause/resume operations on AMD SVM hosts.
Nested guests becoming unresponsive after HLT instructions despite pending wakeup interrupts.
KVM userspace tooling logs showing KVM_SET_VCPU_EVENTS invoked prior to KVM_SET_NESTED_STATE during restore sequences.

Detection Strategies

Audit kernel versions across AMD SVM hypervisor hosts to identify systems running pre-patch builds of the KVM nSVM subsystem.
Review hypervisor and virtualization management logs for repeated L2 guest watchdog timeouts following migration events.
Correlate KVM kvm_nested_vmrun and kvm_nested_intr_vmexit tracepoints with guest unresponsiveness intervals.

Monitoring Recommendations

Enable KVM tracepoints (/sys/kernel/debug/tracing/events/kvm/) to observe nested VMRUN and interrupt delivery sequences.
Track guest heartbeat and watchdog metrics for nested workloads, alerting on extended vCPU stalls.
Inventory all AMD EPYC and Ryzen-based hosts running nested virtualization workloads to scope remediation.

How to Mitigate CVE-2026-45987

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the kernel.org commits to all affected hosts.
Reboot hosts after kernel update to activate the patched KVM module.
Validate nested guest restore workflows after patching to confirm interrupt shadow state is preserved.

Patch Information

The fix synchronizes int_state to the cached vmcb12 inside nested_sync_control_from_vmcb02(), ensuring KVM_SET_NESTED_STATE restores the correct interrupt shadow regardless of the order relative to KVM_SET_VCPU_EVENTS. Patch commits are available at the Kernel Git Commit Changes, Kernel Git Commit Fixes, Kernel Git Commit Updates, Kernel Git Commit Revisions, and Kernel Git Commit Enhancements.

Workarounds

Ensure VM management tooling (libvirt, QEMU, custom orchestrators) invokes KVM_SET_NESTED_STATE before KVM_SET_VCPU_EVENTS during state restore until the patched kernel is deployed.
Disable nested virtualization on AMD SVM hosts where L2 workloads are not required by loading the kvm_amd module with nested=0.
Avoid live migration and snapshot restore operations for nested L2 guests on unpatched hosts.

bash

# Disable nested SVM on AMD hosts as a temporary workaround
sudo modprobe -r kvm_amd
echo "options kvm_amd nested=0" | sudo tee /etc/modprobe.d/kvm-amd.conf
sudo modprobe kvm_amd

# Verify nested support state
cat /sys/module/kvm_amd/parameters/nested