CVE-2026-46059

Source
https://cve.org/CVERecord?id=CVE-2026-46059
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-46059.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-46059
Downstream
Related
Published
2026-05-27T12:57:19.928Z
Modified
2026-06-18T03:54:43.514216813Z
Summary
KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN
Details

In the Linux kernel, the following vulnerability has been resolved:

KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN

For guests with NRIPS disabled, L1 does not provide NextRIP when running an L2 with an injected soft interrupt, instead it advances the current RIP before running it. KVM uses the current RIP as the NextRIP in vmcb02 to emulate a CPU without NRIPS.

However, after L2 runs the first time, NextRIP will be updated by the CPU and/or KVM, and the current RIP is no longer the correct value to use in vmcb02. Hence, after save/restore, use the current RIP if and only if a nested run is pending, otherwise use NextRIP. Give softintnext_rip the same treatment, as it's the same logic, just for a narrower use case.

[sean: give softintnext_rip the same treatment]

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46059.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
cc440cdad5b7a4c1de12dace725209eb3e0cf663
Fixed
3428ed1529a1af4cce5aff6c5bd2fcc39ad726bb
Fixed
69fe1411a5ce678b4da6489b5d2282b4e1d13acf
Fixed
8d397582f6b5e9fbcf09781c7c934b4910e94a50

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-46059.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.8.0
Fixed
6.18.27
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.0.4

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-46059.json"