{"id":"CVE-2026-46071","title":"KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Avoid clearing VMCB_LBR in vmcb12\n\nsvm_copy_lbrs() always marks VMCB_LBR dirty in the destination VMCB.\nHowever, nested_svm_vmexit() uses it to copy LBRs to …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= d20c796ca3709801f8a7fa36e8770a3dd8ebd34e < 165b08d2d1346dce5ed43db65e10f3194b9ae2fe","Linux >= d20c796ca3709801f8a7fa36e8770a3dd8ebd34e < 11d347b7edf5093d69aca72317300798a32bfd6b","Linux >= d20c796ca3709801f8a7fa36e8770a3dd8ebd34e < a3f0981a5a0e0bd51ad74cc7d9eed32294b24002","Linux >= d20c796ca3709801f8a7fa36e8770a3dd8ebd34e < 9efe23568806d1cd06f7d146f9b3037b8d585a9f","Linux >= d20c796ca3709801f8a7fa36e8770a3dd8ebd34e < b53ab5167a81537777ac780bbd93d32613aa3bda","Linux 5.19"],"published":"2026-05-27","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:41:17.270Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-46071","references":[{"url":"https://git.kernel.org/stable/c/165b08d2d1346dce5ed43db65e10f3194b9ae2fe"},{"url":"https://git.kernel.org/stable/c/11d347b7edf5093d69aca72317300798a32bfd6b"},{"url":"https://git.kernel.org/stable/c/a3f0981a5a0e0bd51ad74cc7d9eed32294b24002"},{"url":"https://git.kernel.org/stable/c/9efe23568806d1cd06f7d146f9b3037b8d585a9f"},{"url":"https://git.kernel.org/stable/c/b53ab5167a81537777ac780bbd93d32613aa3bda"}],"tags":["cve.org"],"epss":0.0016,"epssPercentile":0.04793,"ingestedAt":"2026-10-21T12:48:53.631Z","slug":"CVE-2026-46071","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Avoid clearing VMCB_LBR in vmcb12\n\nsvm_copy_lbrs() always marks VMCB_LBR dirty in the destination VMCB.\nHowever, nested_svm_vmexit() uses it to copy LBRs to vmcb12, and\nclearing clean bits in vmcb12 is not architecturally defined.\n\nMove vmcb_mark_dirty() to callers and drop it for vmcb12.\n\nThis also facilitates incoming refactoring that does not pass the entire\nVMCB to svm_copy_lbrs().\n\n## Affected\n\n- `Linux >= d20c796ca3709801f8a7fa36e8770a3dd8ebd34e < 165b08d2d1346dce5ed43db65e10f3194b9ae2fe`\n- `Linux >= d20c796ca3709801f8a7fa36e8770a3dd8ebd34e < 11d347b7edf5093d69aca72317300798a32bfd6b`\n- `Linux >= d20c796ca3709801f8a7fa36e8770a3dd8ebd34e < a3f0981a5a0e0bd51ad74cc7d9eed32294b24002`\n- `Linux >= d20c796ca3709801f8a7fa36e8770a3dd8ebd34e < 9efe23568806d1cd06f7d146f9b3037b8d585a9f`\n- `Linux >= d20c796ca3709801f8a7fa36e8770a3dd8ebd34e < b53ab5167a81537777ac780bbd93d32613aa3bda`\n- `Linux 5.19`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}