CVE-2026-46014 Overview
CVE-2026-46014 is a Linux kernel vulnerability affecting the Kernel-based Virtual Machine (KVM) Secure Virtual Machine (SVM) subsystem on AMD platforms. The flaw stems from missing save and restore handling of Last Branch Record (LBR) Model-Specific Registers (MSRs). MSR_IA32_DEBUGCTLMSR and LBR MSRs are not enumerated by KVM_GET_MSR_INDEX_LIST, and LBR MSRs cannot be set via KVM_SET_MSRS. As a result, save and restore operations for these registers are broken. The issue also impacts VMX, where MSR_IA32_DEBUGCTLMSR is similarly not reported as a save/restore MSR.
Critical Impact
Virtual machine state involving LBR and debug control MSRs cannot be reliably saved or restored, breaking live migration and snapshot fidelity for guests relying on LBR virtualization.
Affected Products
- Linux kernel KVM subsystem (SVM module) on AMD CPUs with LBR virtualization (LBRV) enabled
- Linux kernel KVM subsystem (VMX module) for MSR_IA32_DEBUGCTLMSR save/restore handling
- Userspace VMMs relying on KVM_GET_MSR_INDEX_LIST and KVM_SET_MSRS for LBR state
Discovery Timeline
- 2026-05-27 - CVE-2026-46014 published to the National Vulnerability Database (NVD)
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46014
Vulnerability Analysis
The vulnerability resides in KVM's handling of LBR-related MSRs on AMD SVM. KVM exposes a list of MSRs that userspace must save and restore through the KVM_GET_MSR_INDEX_LIST ioctl. MSR_IA32_DEBUGCTLMSR and the LBR MSRs were omitted from this list. Additionally, KVM_SET_MSRS rejected writes to LBR MSRs because they are read-only from the guest's perspective. The combination prevents userspace VMMs from migrating or snapshotting a virtual machine without losing branch-tracing state. When nested virtualization is in use, L1's LBR state can also be lost while L2 is running because the values are not propagated from the captured VMCB01 save area during state copy operations.
Root Cause
The root cause is incomplete enumeration of the MSRs requiring migration support and a missing userspace write path for LBR MSRs. KVM treated LBR MSRs as guest read-only and did not distinguish between guest writes and userspace writes performed for state restoration. The nested transition path in svm_copy_vmrun_state() did not copy LBR values from VMCB01, so L1 LBR contents were dropped on entry to L2.
Attack Vector
This is a correctness and data integrity defect in virtualization state handling rather than a remotely exploitable memory corruption issue. The impact surfaces during VM lifecycle operations such as live migration, save/restore, and nested guest execution, producing inconsistent debug and branch-tracing state in guests using LBR virtualization.
No verified proof-of-concept code is published for this issue. Refer to the upstream commits Kernel Git Commit 13a89ada, Kernel Git Commit 2b922a42, and Kernel Git Commit 3700f078 for the implementation details.
Detection Methods for CVE-2026-46014
Indicators of Compromise
- No malware or exploit indicators apply to this issue because it is a functional defect in KVM state management rather than an attack technique.
- Symptoms include missing or stale LBR values in guests after migration or snapshot restore.
- Userspace VMM logs reporting KVM_SET_MSRS failures for LBR MSR indices.
Detection Strategies
- Inventory Linux hypervisors running KVM with AMD SVM and LBR virtualization enabled (lbrv=1).
- Compare the running kernel version against the fixed commits referenced in the upstream advisory to identify unpatched hosts.
- Validate VM live migration and save/restore tests by checking guest LBR MSR contents before and after the operation.
Monitoring Recommendations
- Track kernel package versions across the hypervisor fleet using configuration management telemetry.
- Audit KVM_GET_MSR_INDEX_LIST output on hosts to confirm MSR_IA32_DEBUGCTLMSR and LBR MSRs appear after patching.
- Monitor VMM logs for ioctl errors during VM state transfer operations.
How to Mitigate CVE-2026-46014
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced by commits 13a89ada, 2b922a42, and 3700f078 to all affected hypervisors.
- Update to a distribution kernel that incorporates these fixes once the vendor releases backports.
- Reboot affected hosts after kernel updates so the new KVM module is loaded.
Patch Information
The fix adds MSR_IA32_DEBUGCTLMSR and the LBR MSRs to msrs_to_save_base, allows writes to LBR MSRs from userspace only when LBR virtualization is enabled, and updates svm_copy_vmrun_state() to copy LBR values from the captured VMCB01 save area. The change also resolves the related VMX gap where MSR_IA32_DEBUGCTLMSR was not reported for save/restore. See Kernel Git Commit 13a89ada, Kernel Git Commit 2b922a42, and Kernel Git Commit 3700f078.
Workarounds
- Disable LBR virtualization on AMD hosts by loading the kvm_amd module with lbrv=0 until patches are applied.
- Avoid relying on guest LBR contents across live migration or save/restore operations on unpatched hosts.
- Schedule guests requiring LBR fidelity only on hypervisors confirmed to include the upstream fix.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
