Linux Kernel up to 7.0.3 nested_svm_vmexit injection

Summaryinfo

A vulnerability classified as critical was found in Linux Kernel up to 7.0.3. Affected by this issue is the function nested_svm_vmexit. Executing a manipulation can lead to injection. This vulnerability appears as CVE-2026-46032. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 7.0.3 and classified as critical. This vulnerability affects the function nested_svm_vmexit. The manipulation with an unknown input leads to a injection vulnerability. The CWE definition for the vulnerability is CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT If loading L1's CR3 fails on a nested #VMEXIT, nested_svm_vmexit() returns an error code that is ignored by most callers, and continues to run L1 with corrupted state. A sane recovery is not possible in this case, and HW behavior is to cause a shutdown. Inject a triple fault instead, and do not return early from nested_svm_vmexit(). Continue cleaning up the vCPU state (e.g. clear pending exceptions), to handle the failure as gracefully as possible. From the APM: Upon #VMEXIT, the processor performs the following actions in order to return to the host execution context: ... if (illegal host state loaded, or exception while loading host state) shutdown else execute first host instruction following the VMRUN Remove the return value of nested_svm_vmexit(), which is mostly unchecked anyway.

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2026-46032 since 05/13/2026. The exploitation appears to be difficult. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/17/2026). The MITRE ATT&CK project declares the attack technique as T1055.

Upgrading to version 7.0.4 or 7.1-rc1 eliminates this vulnerability. Applying the patch 9a738cf170a4a2332ea3a15e23ec65b5757fe4a1/5d291ef0585ed880ed4dd71ea1a5965e0a65fb53 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion