CVE-2026-46082: Linux Kernel KVM SVM Exception Vulnerability

CVE-2026-46082 Overview

CVE-2026-46082 affects the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem for AMD Secure Virtual Machine (SVM). The flaw resides in the handling of the INVLPGA instruction. When EFER.SVME=0, KVM fails to inject an #UD (invalid opcode) exception as required by the AMD architecture specification. This permits guest virtual machines to execute INVLPGA outside the conditions in which it is architecturally valid. The upstream fix adds an explicit check that injects #UD when EFER.SVME is clear, restoring conformance with the AMD64 specification.

Critical Impact
Guest virtual machines on AMD hosts can execute INVLPGA without the architectural #UD exception, producing an inconsistent virtualization state when EFER.SVME=0.

Affected Products

Linux kernel KVM subsystem on AMD SVM-capable hosts
Stable kernel branches referenced by patches 3ac9d42, 643125b, c15392e, d99df02, and ee24928
Hypervisor deployments using KVM/SVM for AMD-based virtualization

Discovery Timeline

2026-05-27 - CVE-2026-46082 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46082

Vulnerability Analysis

The issue is located in the KVM SVM emulation path that processes the INVLPGA instruction. INVLPGA is an SVM-specific instruction used by hypervisors to invalidate TLB entries for a given Address Space Identifier (ASID). According to the AMD architecture specification, executing INVLPGA is only legal when the Secure Virtual Machine Enable bit (EFER.SVME) is set. When EFER.SVME=0, the processor must raise an invalid opcode exception (#UD).

KVM's emulation path did not enforce this precondition. A guest could trigger the INVLPGA handler in the hypervisor while EFER.SVME was clear and avoid the architectural #UD. The fix introduces an explicit check that injects #UD whenever EFER.SVME=0, aligning KVM behavior with hardware semantics. The patch was tagged for stable@ to backport the correction across maintained kernel trees.

Root Cause

The root cause is a missing precondition check in the KVM SVM instruction emulation logic [Kernel Vulnerability]. The handler for INVLPGA did not validate the state of EFER.SVME before proceeding, allowing the instruction to be processed when it should have been rejected with #UD.

Attack Vector

Exploitation requires the ability to execute code inside a guest virtual machine running on a KVM/SVM hypervisor. A guest issues INVLPGA while EFER.SVME=0, observing behavior that diverges from the AMD specification. No public proof-of-concept, exploit, or CISA KEV listing is associated with this entry. See the upstream patches for the precise change to the emulation path.

Detection Methods for CVE-2026-46082

Indicators of Compromise

No public indicators of compromise are associated with CVE-2026-46082 at the time of publication.
Anomalous guest-issued INVLPGA instructions observed while EFER.SVME=0 may indicate probing of the affected emulation path.

Detection Strategies

Inventory Linux hypervisor hosts running AMD SVM with KVM and identify kernel versions predating the fixes in commits 3ac9d42, 643125b, c15392e, d99df02, and ee24928.
Correlate kernel build identifiers with distribution security advisories to determine which hosts require backported fixes.
Track guest exit reasons in KVM tracing (kvm_exit, kvm_emulate_insn) for unexpected INVLPGA emulation events.

Monitoring Recommendations

Enable kernel auditing on KVM hosts and monitor dmesg for emulation warnings tied to SVM instruction handling.
Track guest-to-host transitions and emulation counters via perf and tracefs to baseline normal hypervisor behavior.
Maintain centralized log collection for hypervisor hosts so that anomalous virtualization events can be reviewed during incident response.

How to Mitigate CVE-2026-46082

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry to all AMD-based KVM hypervisor hosts.
Coordinate with your Linux distribution vendor to obtain backported stable kernel builds containing the fix.
Schedule reboots of affected hypervisor hosts after kernel update, draining guest workloads in advance.

Patch Information

Fixes are available in the upstream stable tree via the following commits: Linux Kernel Patch 3ac9d42, Linux Kernel Patch 643125b, Linux Kernel Patch c15392e, Linux Kernel Patch d99df02, and Linux Kernel Patch ee24928. Each patch adds the EFER.SVME precondition check and injects #UD when the bit is clear.

Workarounds

No vendor-supplied workaround removes the underlying defect; kernel update is the supported remediation path.
Where patching is delayed, restrict the ability of untrusted tenants to run nested or privileged guest workloads on affected AMD KVM hosts.
Migrate sensitive virtual machines to already-patched hypervisor hosts before applying updates to remaining nodes.

bash

# Verify running kernel version and confirm patch presence on Linux hypervisor hosts
uname -r
rpm -q --changelog kernel | grep -i 'INVLPGA\|EFER.SVME' || \
  dpkg-query -W -f='${Version}\n' linux-image-$(uname -r)