Medium 5.5Published May 27, 2026

CVE-2026-46082KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0

Updated under an hour ago (Oct 26, 2026, 6:00 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 INVLPGA should cause a #UD when EFER.SVME is not set. Add a check to properly inject #UD when EFER.SVME=0. [sean: tag for stable@]

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Undergoing Analysis
Record last updated: Jun 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ff092385e8285c03d8b148f42f46f98c5f4becd5 before ebb63390142c6458fc37758e0892759989cc159f; from ff092385e8285c03d8b148f42f46f98c5f4becd5 before 491139c17f8ad5773303068411f6ac5eed438b51; from ff092385e8285c03d8b148f42f46f98c5f4becd5 before 3ac9d4241d205f5d0df06358349ca718ebb0fa12; from ff092385e8285c03d8b148f42f46f98c5f4becd5 before 643125b66ffc1147c66616b749475ba9efb15971; from ff092385e8285c03d8b148f42f46f98c5f4becd5 before c15392ed9e49c1a16b4d3a3ccf1b3bf2318a6c28; from ff092385e8285c03d8b148f42f46f98c5f4becd5 before ee24928ecd85db4b68ed111e91fef36af0ca37b0; from ff092385e8285c03d8b148f42f46f98c5f4becd5 before d99df02ff427f461102230f9c5b90a6c64ee8e23	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.32 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.140; from 6.7 before 6.12.86; from 6.13 before 6.18.27; from 6.19 before 7.0.4	NVD

References

References

https://git.kernel.org/stable/c/ebb63390142c6458fc37758e0892759989cc159f	patch
https://git.kernel.org/stable/c/491139c17f8ad5773303068411f6ac5eed438b51	patch
https://git.kernel.org/stable/c/3ac9d4241d205f5d0df06358349ca718ebb0fa12	patch
https://git.kernel.org/stable/c/643125b66ffc1147c66616b749475ba9efb15971	patch
https://git.kernel.org/stable/c/c15392ed9e49c1a16b4d3a3ccf1b3bf2318a6c28	patch
https://git.kernel.org/stable/c/ee24928ecd85db4b68ed111e91fef36af0ca37b0	patch
https://git.kernel.org/stable/c/d99df02ff427f461102230f9c5b90a6c64ee8e23	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.