CVE-2026-46131: Linux Kernel Privilege Escalation Flaw

CVE-2026-46131 Overview

CVE-2026-46131 is a Linux kernel vulnerability in the Kernel-based Virtual Machine (KVM) x86 subsystem. The flaw involves an incorrect guest-mode check in slow flush hypercalls. The original code uses is_guest_mode(vcpu) to gate calls to translate_nested_gpa(), but that helper is only valid when an L2 guest runs with nested Extended Page Tables (nEPT) or nested Nested Page Tables (nNPT) enabled. The fix replaces the check with the same condition used inside translate_nested_gpa() itself, preventing incorrect translation logic when nested paging is not active.

Critical Impact
Incorrect nested guest physical address translation in KVM slow flush hypercalls can lead to inconsistent TLB flush behavior for L2 guests running without nested EPT/NPT.

Affected Products

Linux kernel KVM x86 subsystem
Hosts running L1 hypervisors with nested virtualization on Intel (VMX) or AMD (SVM) hardware
Distributions shipping affected upstream Linux kernel versions prior to the referenced stable commits

Discovery Timeline

2026-05-28 - CVE-2026-46131 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46131

Vulnerability Analysis

The vulnerability resides in the KVM x86 implementation of slow flush hypercalls. KVM exposes paravirtualized TLB flush hypercalls that, in nested virtualization scenarios, may need to translate L2 guest physical addresses into L1 guest physical addresses. This translation is performed by translate_nested_gpa(), which is only semantically valid when the L2 guest is running with nested paging enabled (nEPT on Intel or nNPT on AMD).

The original code gated the translation on is_guest_mode(vcpu), which only confirms that the vCPU is currently executing an L2 guest. It does not confirm that nested EPT or nested NPT is active. As a result, the translation path can execute against an L2 guest that uses shadow paging instead of nested paging, producing incorrect address translation.

Root Cause

The root cause is an overly broad precondition check [CWE-840 Business Logic Errors / improper validation]. is_guest_mode(vcpu) and the actual requirement for translate_nested_gpa() are not equivalent. The patch aligns the hypercall check with the same condition translate_nested_gpa() uses internally, ensuring the translation routine is invoked only when its assumptions hold.

Attack Vector

Exploitation requires the ability to issue KVM paravirtual flush hypercalls from inside a nested virtualization configuration. A malicious or buggy L1 hypervisor running an L2 guest without nested EPT/NPT could trigger the incorrect path. The likely impact is inconsistent TLB flushing or guest-mode state confusion within the host kernel rather than direct memory corruption. See the upstream patches for the precise behavioral change.

No verified public exploit code is available. Technical details are documented in the upstream commits: 45fc766bc756, 464af6fc2b1d, 4c7f8436b19a, 971f17f5d910, and d6f4e217d663.

Detection Methods for CVE-2026-46131

Indicators of Compromise

No specific indicators of compromise have been published for this vulnerability.
Anomalous KVM hypercall patterns from nested guests may warrant investigation.

Detection Strategies

Inventory hosts running KVM with nested virtualization enabled and compare installed kernel versions against the fixed upstream commits.
Audit running kernels using uname -r and the distribution's kernel changelog to confirm the backport status of the listed commits.
Monitor for unexpected guest crashes or TLB consistency issues in L2 guests that do not use nested EPT/NPT.

Monitoring Recommendations

Enable kernel tracepoints for KVM hypercalls (kvm_hypercall) and correlate with guest crash events.
Track Linux kernel CVE feeds for additional KVM nested virtualization fixes and pair with configuration management telemetry.
Log virtualization host kernel versions in your asset inventory to expedite future kernel CVE response.

How to Mitigate CVE-2026-46131

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution that includes the referenced commits.
Reboot virtualization hosts after kernel upgrade to load the patched KVM module.
Where patching is not immediately possible, restrict deployment of untrusted nested L1 hypervisors on shared infrastructure.

Patch Information

The fix is upstream in the Linux kernel stable tree. Reference commits include 45fc766bc756, 464af6fc2b1d, 4c7f8436b19a, 971f17f5d910, and d6f4e217d663. Each commit replaces the is_guest_mode(vcpu) check in slow flush hypercalls with the same condition used by translate_nested_gpa(). Consult your distribution vendor's advisory for the specific package version that includes the backport.

Workarounds

Disable nested virtualization on KVM hosts if it is not required by setting the kvm-intel.nested=0 or kvm-amd.nested=0 module parameter.
Avoid running L2 guests without nested EPT/NPT until the host kernel is patched.

bash

# Check current kernel version and nested virtualization status
uname -r
cat /sys/module/kvm_intel/parameters/nested 2>/dev/null
cat /sys/module/kvm_amd/parameters/nested 2>/dev/null

# Disable nested virtualization (Intel) until patched
sudo modprobe -r kvm_intel
sudo modprobe kvm_intel nested=0

# Persist via modprobe configuration
echo 'options kvm_intel nested=0' | sudo tee /etc/modprobe.d/kvm-nested.conf