VulnerabilityPublished 27 May 2026Updated 21 Oct 2026

CVE-2026-46032: Linux kernel · KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in b0eb0a8959ac2b808eb11548d002fe1f9b5650cc : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:30 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.1% chance of exploitation in 30 days – higher than 2% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in b0eb0a8959ac2b808eb11548d002fe1f9b5650cc, af79992ecdb6817970d757fb5d853b8d9b55a0d6, 9a738cf170a4a2332ea3a15e23ec65b5757fe4a1 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 27 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ d82aaef9c88aa27bce63751d6d6329920b1fe8da, < b0eb0a8959ac2b808eb11548d002fe1f9b5650cc	Fixed in b0eb0a8959ac2b808eb11548d002fe1f9b5650cc
LinuxLinux	Affected ≥ d82aaef9c88aa27bce63751d6d6329920b1fe8da, < af79992ecdb6817970d757fb5d853b8d9b55a0d6	Fixed in af79992ecdb6817970d757fb5d853b8d9b55a0d6
LinuxLinux	Affected ≥ d82aaef9c88aa27bce63751d6d6329920b1fe8da, < 9a738cf170a4a2332ea3a15e23ec65b5757fe4a1	Fixed in 9a738cf170a4a2332ea3a15e23ec65b5757fe4a1
LinuxLinux	Affected ≥ d82aaef9c88aa27bce63751d6d6329920b1fe8da, < 5d291ef0585ed880ed4dd71ea1a5965e0a65fb53	Fixed in 5d291ef0585ed880ed4dd71ea1a5965e0a65fb53
LinuxLinux	Affected ≥ d82aaef9c88aa27bce63751d6d6329920b1fe8da, < 2e661773890e6ba6b16064fad961da3dd311be43	Fixed in 2e661773890e6ba6b16064fad961da3dd311be43
LinuxLinux	Affected =5.9	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT If loading L1's CR3 fails on a nested #VMEXIT, nested_svm_vmexit() returns an error code that is ignored by most callers, and continues to run L1 with corrupted state. A sane recovery is not possible in this case, and HW behavior is to cause a shutdown. Inject a triple fault instead, and do not return early from nested_svm_vmexit(). Continue cleaning up the vCPU state (e.g. clear pending exceptions), to handle the failure as gracefully as possible. From the APM: Upon #VMEXIT, the processor performs the following actions in order to return to the host execution context: ... if (illegal host state loaded, or exception while loading host state) shutdown else execute first host instruction following the VMRUN Remove the return value of nested_svm_vmexit(), which is mostly unchecked anyway.

References

Community reviews

Loading reviews…