CVE-2026-46295: Linux Kernel KVM Race Condition Flaw

CVE-2026-46295 Overview

CVE-2026-46295 is a race condition in the Linux kernel's KVM (Kernel-based Virtual Machine) x86 subsystem. The flaw resides in __kvm_apic_update_irr() and manifests during posted interrupt processing on nested virtual machines. When PID.ON is set but the Posted Interrupt Request (PIR) bitmap turns out to be empty, the function fails to fall back to apic_find_highest_vector() to scan the Interrupt Request Register (IRR). This produces an incorrect max_irr value of -1 even though a pending interrupt exists in the IRR from a prior synchronization. The result is a spurious WARNING in vmx_check_nested_events() and a wasted L2 VM-Enter/VM-Exit cycle. The interrupt itself is not lost, but the inconsistency degrades nested virtualization reliability.

Critical Impact
A race between vmx_sync_pir_to_irr() and __vmx_deliver_posted_interrupt() causes KVM to misreport pending interrupts on nested VMs, triggering kernel warnings and wasted VM-Exit cycles under heavy interrupt load.

Affected Products

Linux kernel — KVM x86 subsystem (arch/x86/kvm/vmx/nested.c, arch/x86/kvm/lapic.c)
Intel VMX nested virtualization configurations using posted interrupts
Stable kernel branches receiving the backported fix commits

Discovery Timeline

2026-06-08 - CVE-2026-46295 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-46295

Vulnerability Analysis

The defect is a Time-of-Check Time-of-Use (TOCTOU) style race between two vCPUs handling posted interrupts. The sender vCPU executes two atomic operations that are not part of a single transaction: pi_test_and_set_pir(vector) sets the PIR bit, followed by pi_test_and_set_on() which sets PID.ON. The target vCPU's vmx_sync_pir_to_irr() may execute between these two operations.

During the first synchronization, the target clears ON, harvests the PIR bit set by step B1, and transfers it to the IRR via xchg(). The sender then completes step B2 by setting PID.ON = 1. On the subsequent synchronization, the target observes pi_test_on() as TRUE, clears ON, but finds the PIR empty because the bit was already consumed. The function then sets *max_irr = -1 and returns early without scanning the IRR.

Root Cause

The root cause is a missing fallback path in __kvm_apic_update_irr(). When PID.ON is observed as set but PIR yields no bits, the function must still invoke apic_find_highest_vector() against the IRR to report the highest pending interrupt. Skipping this scan creates inconsistency between kvm_cpu_has_interrupt() and kvm_apic_has_interrupt() results.

Attack Vector

The issue is triggered by legitimate guest workloads that generate frequent inter-processor interrupts under nested virtualization stress. It is a stability and correctness bug rather than a directly exploitable security flaw. It fires the WARNING at arch/x86/kvm/vmx/nested.c:4449 and degrades nested guest performance through unnecessary L2 VM-Enter/VM-Exit cycles.

No proof-of-concept exploit is available. The condition reproduces under high-frequency posted interrupt delivery to vCPUs running nested guests. See the kernel commit fixing __kvm_apic_update_irr for the precise interleaving and fix details.

Detection Methods for CVE-2026-46295

Indicators of Compromise

Kernel WARNING messages originating at arch/x86/kvm/vmx/nested.c:4449 inside vmx_check_nested_events+0x6bf/0x6e0 [kvm_intel].
Call traces showing kvm_check_and_inject_events → vcpu_enter_guest → vcpu_run → kvm_arch_vcpu_ioctl_run on hosts running nested VMs.
Elevated nested VM-Exit counters with no corresponding guest activity, visible via perf kvm stat on Intel hosts.

Detection Strategies

Scan host dmesg and journalctl -k output for the specific vmx_check_nested_events warning signature on Intel KVM hosts.
Track kernel version inventory across the hypervisor fleet to identify hosts missing the upstream stable commits.
Correlate guest performance complaints from L2 workloads with host WARN_ON occurrences to confirm impact.

Monitoring Recommendations

Forward kernel ring buffer events from KVM hosts to a centralized logging pipeline and alert on KVM WARNING and WARN_ON lines.
Monitor /sys/kernel/debug/kvm/ counters for unusual posted interrupt and VM-Exit patterns where instrumentation is enabled.
Establish baseline kernel build SHAs for hypervisor hosts and alert on drift from patched stable releases.

How to Mitigate CVE-2026-46295

Immediate Actions Required

Identify all Intel-based KVM hypervisor hosts running nested virtualization and inventory their kernel versions.
Schedule maintenance windows to apply the upstream stable kernel update containing the __kvm_apic_update_irr fallback fix.
Reduce reliance on nested virtualization workloads on unpatched hosts until updates are deployed.

Patch Information

The fix is committed to the Linux stable tree. Apply the kernel update containing the following commits:

Distribution-provided kernel updates incorporating these commits should be installed through the standard package manager and the host rebooted to load the patched kernel.

Workarounds

Disable nested virtualization on affected hosts by reloading kvm_intel with nested=0 where workloads permit.
Migrate nested guest workloads to already-patched hosts before scheduling updates on remaining systems.
Treat the kernel WARNING as benign for interrupt correctness, since the interrupt is recovered on the next vcpu_enter_guest() iteration, while still prioritizing the patch.

bash

# Verify running kernel and check for the fix
uname -r

# Disable nested virtualization on Intel KVM hosts as a temporary workaround
sudo modprobe -r kvm_intel
echo 'options kvm_intel nested=0' | sudo tee /etc/modprobe.d/kvm-intel.conf
sudo modprobe kvm_intel

# Confirm nested is disabled
cat /sys/module/kvm_intel/parameters/nested