High 7.9Published May 6, 2026

CVE-2026-43133KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation

Updated under an hour ago (Oct 27, 2026, 2:30 PM ET)

Does this affect you?

It affects Linux and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation Commit cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload of guest state") made KVM always use vmcb01 for the fields controlled by VMSAVE/VMLOAD, but it missed updating the VMLOAD/VMSAVE emulation code to always use vmcb01. As a result, if VMSAVE/VMLOAD is executed by an L2 guest and is not intercepted by L1, KVM will mistakenly use vmcb02. Always use vmcb01 instead of the current VMCB.

CVSS: 7.9 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Weakness (CWE): CWE-628, CWE-754
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from cc3ed80ae69f454c3d904af9f65394a540099723 before 10063e1251c1485034a018236080792ad083dcc5; from cc3ed80ae69f454c3d904af9f65394a540099723 before c3b7015000988ba35ecd5648f4b2283960f00543; from cc3ed80ae69f454c3d904af9f65394a540099723 before 3880e331b0b31d0d5d3702b124f6c93539cd478a; from cc3ed80ae69f454c3d904af9f65394a540099723 before fce2fd4a2ca05670a91015aacccf96a1c26268fd; from cc3ed80ae69f454c3d904af9f65394a540099723 before d464cf1ed900d47c85393d40b00017b6adfc2e6c; from cc3ed80ae69f454c3d904af9f65394a540099723 before 0004ecb798b30e90d7ebfe74efae2d9423315a64; from cc3ed80ae69f454c3d904af9f65394a540099723 before 127ccae2c185f62e6ecb4bf24f9cb307e9b9c619	CNA record
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux	from 0:6.12.0-211.53.1.el10_2 not affected	CISA ADP
Red Hat Red Hat OpenShift Container Platform 4 redhat:openshift	4	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.13 before 5.15.202; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6	NVD

References

References

https://git.kernel.org/stable/c/10063e1251c1485034a018236080792ad083dcc5	patch
https://git.kernel.org/stable/c/c3b7015000988ba35ecd5648f4b2283960f00543	patch
https://git.kernel.org/stable/c/3880e331b0b31d0d5d3702b124f6c93539cd478a	patch
https://git.kernel.org/stable/c/fce2fd4a2ca05670a91015aacccf96a1c26268fd	patch
https://git.kernel.org/stable/c/d464cf1ed900d47c85393d40b00017b6adfc2e6c	patch
https://git.kernel.org/stable/c/0004ecb798b30e90d7ebfe74efae2d9423315a64	patch
https://git.kernel.org/stable/c/127ccae2c185f62e6ecb4bf24f9cb307e9b9c619	patch
https://access.redhat.com/errata/RHSA-2026:65334
https://access.redhat.com/errata/RHSA-2026:66180
https://access.redhat.com/errata/RHSA-2026:66357
1–10 of 15

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.