CVE-2026-46032

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT If loading L1's CR3 fails on a nested #VMEXIT, nested_svm_vmexit() returns an error code that is ignored by most callers, and continues to run L1 with corrupted state. A sane recovery is not possible in this case, and HW behavior is to cause a shutdown. Inject a triple fault instead, and do not return early from nested_svm_vmexit(). Continue cleaning up the vCPU state (e.g. clear pending exceptions), to handle the failure as gracefully as possible. From the APM: Upon #VMEXIT, the processor performs the following actions in order to return to the host execution context: ... if (illegal host state loaded, or exception while loading host state) shutdown else execute first host instruction following the VMRUN Remove the return value of nested_svm_vmexit(), which is mostly unchecked anyway.

Overview

State: PUBLISHED
Assigner (CNA): Linux
CVSS severity: high
CVSS score: 7.3 / 10
CVSS vector: AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Effective score: 7.3 / 10 HIGH source: CNA overview
MSRC score: 7.0 / 10 HIGH MS rating: Moderate
CWE(s): —
Reserved: 2026-05-13
Published: 2026-05-27 12:56 UTC
Last updated: 2026-05-27 12:56 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46032.json
Linked Threat: CVE-2026-46032 — CVE-2026-46032

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-05-27 14:17:22 UTC
NVD last modified: 2026-06-17 10:52:56 UTC
NVD CVSS v3.1: 5.5 / 10 MEDIUM source: nvd@nist.gov
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability subscore: 1.8 / 10
Impact subscore: 3.6 / 10
EPSS score: 0.0012 (probability of exploitation in next 30 days)
EPSS percentile: 1.87% vs all CVEs — higher = more likely to be exploited, as of 2026-07-26

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-32413
Assigner: Linux
Published: May 27, 2026, 12:56:41 PM
Updated: Jun 14, 2026, 5:49:20 PM
EUVD base score: 0.0 / 10
EUVD-reported EPSS: 0.1200
Vendors: Linux
Products: Linux (patch: 0)

Linux (5.9)

Linux (patch: 7.1)

Linux (d82aaef9c88aa27bce63751d6d6329920b1fe8da <9a738cf170a4a2332ea3a15e23ec65b5757fe4a1)

Linux (d82aaef9c88aa27bce63751d6d6329920b1fe8da <5d291ef0585ed880ed4dd71ea1a5965e0a65fb53)

Linux (patch: 7.0.4)
Aliases: GHSA-rgj9-vx7j-x86j

ENISA description: In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT If loading L1's CR3 fails on a nested #VMEXIT, nested_svm_vmexit() returns an error code that is ignored by most callers, and continues to run L1 with corrupted state. A sane recovery is not possible in this case, and HW behavior is to cause a shutdown. Inject a triple fault instead, and do not return early from nested_svm_vmexit(). Continue cleaning up the vCPU state (e.g. clear pending exceptions), to handle the failure as gracefully as possible. From the APM: Upon #VMEXIT, the processor performs the following actions in order to return to the host execution context: ... if (illegal host state loaded, or exception while loading host state) shutdown else execute first host instruction following the VMRUN Remove the return value of nested_svm_vmexit(), which is mostly unchecked anyway.

EUVD references (2)

Microsoft Security Response Center MSRC

Microsoft's vendor-authoritative record from the Security Update Guide — its own CVSS score, impact, severity rating, exploit assessment, and KB-article fixes. Refreshed 2026-08-12 01:09 UTC (source: CVRF).

MS severity: Moderate
MS CVSS base score: 7.0 / 10 (temporal 6.4)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U
Release: 2026-May

Affected products (2)

Vendor	Product	Versions	Platforms
Linux	Linux	`d82aaef9c88aa27bce63751d6d6329920b1fe8da` (affected), `d82aaef9c88aa27bce63751d6d6329920b1fe8da` (affected)	—
Linux	Linux	`5.9` (affected), `0` (unaffected), `7.0.4` (unaffected), `7.1-rc1` (unaffected)	—

Affected products — CPE 2.3 (1) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Vendor references (2)

References embedded in the original CVE record by the assigning CNA.

Web references (6)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

MSRC update guide: CVE-2026-46032 msrc
https://git.kernel.org/stable/c/5d291ef0585ed880ed4dd71ea1a5965e0a65fb53 tenable:git.kernel.org
https://git.kernel.org/stable/c/9a738cf170a4a2332ea3a15e23ec65b5757fe4a1 tenable:git.kernel.org
https://nvd.nist.gov/vuln/detail/CVE-2026-46032 tenable:nvd.nist.gov
https://www.cve.org/CVERecord?id=CVE-2026-46032 tenable:www.cve.org
https://www.first.org/epss/ tenable:www.first.org

NVD-tagged references (2)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://git.kernel.org/stable/c/5d291ef0585ed880ed4dd71ea1a5965e0a65fb53 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/9a738cf170a4a2332ea3a15e23ec65b5757fe4a1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch

Remediations (18)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

cve-details - Red Hat Customer Portal

web:access.redhat.com

We're sorry but cve -details doesn't work properly without JavaScript enabled. Please enable it to continue.

2026-06-04 00:14 UTC
CVE-2026-46032 - Vulnerability Details - OpenCVE

web:app.opencve.io

Remediation No vendor fix or workaround currently provided. OpenCVE Recommended Actions Apply a Linux kernel update that includes the KVM:nSVM patch removing the ignored return value from nested_svm_vmexit () and enforcing shutdown, as referenced in the supplied git commits.

2026-06-04 00:14 UTC
Microsoft Patch Tuesday May 2026 - 120 Vulnerabilities Fixed, Including ...

web:cybersecuritynews.com

Microsoft's May 2026 Patch Tuesday lands with a heavy enterprise focus, fixing 120 vulnerabilities across Windows, Office, Azure, developer tools, and Microsoft 365 apps, including 29 remote code execution (RCE) flaws rated Critical.

2026-06-04 00:14 UTC
In the Linux kernel, the following vulnerability has been...

web:github.com

In the Linux kernel, the following vulnerability has been... · CVE-2026-46032 · GitHub Advisory Database · GitHub GitHub Advisory Database Unreviewed CVE-2026-46032

2026-06-04 00:14 UTC
Nvd - Cve-2026-46032

web:nvd.nist.gov

Quick Info CVE Dictionary Entry: CVE-2026-46032 NVD Published Date: 05/27/ 2026 NVD Last Modified: 05/27/ 2026 Source: kernel.org

2026-06-04 00:14 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-06-04 00:14 UTC
Oracle Critical Security Patch Update Advisory - May 2026

web:www.oracle.com

This Critical Security Patch Update contains 35 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Security Patch Update and other Oracle Software Security Assurance activities is located at May 2026 Critical Security Patch Update: Executive Summary and Analysis.

2026-06-04 00:14 UTC
Windows 11's Secure Boot fix update finally rolls out to ... - PCWorld

web:www.pcworld.com

Windows 11's Secure Boot fix update finally rolls out to more PCs Important security certificates for Windows 11 will soon expire for many users.

2026-06-04 00:14 UTC
CVE-2026-46032 | Tenable®

web:www.tenable.com

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT If loading L1's CR3 fails on a ...

2026-06-04 00:14 UTC
CVE-2026-46032 - Info Vulnerability - TheHackerWire

web:www.thehackerwire.com

How do I fix or mitigate CVE-2026-46032 ? To protect against CVE-2026-46032 , you should: (1) Apply the latest security patches from the vendor, (2) Check official security advisories for specific remediation steps, (3) Update affected software to the latest version, and (4) Monitor your systems for any signs of exploitation.

2026-06-04 00:14 UTC
Security Update Guide - Loading - Microsoft

web:msrc.microsoft.com

Something went wrong! You may want to try the following troubleshooting steps: Refresh the page and try again. Log out and log back in and try again. Clear your ...

2026-06-19 02:27 UTC
NVD - Home

web:nvd.nist.gov

The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics. For ...

2026-06-19 02:27 UTC
Oracle CPU April 2026: Delayed RUs & First Analysis ¶

web:oradba.ch

On April 21, 2026 , Oracle released the Critical Patch Update (CPU) for April 2026 — 481 new security fixes across the entire Oracle product stack. For Oracle Database, this means another round of mandatory patching. What makes this quarter unusual: several key Release Updates, including 19.31 and 23.26.2, were not available on release day and are delayed by up to a week or more.

2026-06-19 02:27 UTC
April 2026 Patch Tuesday: Updates and Analysis | CrowdStrike

web:www.crowdstrike.com

Microsoft's April 2026 Patch Tuesday addresses 164 CVEs , featuring 8 Critical vulnerabilities, one exploited zero-day, and one disclosed zero-day.

2026-06-19 02:27 UTC
May 2026 Patch Tuesday: Updates and Analysis | CrowdStrike

web:www.crowdstrike.com

Microsoft has released security updates for 130 vulnerabilities, including 30 critical, in its May 2026 Patch Tuesday rollout.

2026-06-19 02:27 UTC
Oracle Critical Patch Update Advisory - April 2026

web:www.oracle.com

This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

2026-06-19 02:27 UTC
Oracle's Second Monthly Security Updates Deliver 245 Patches

web:www.securityweek.com

Vulnerabilities Oracle's Second Monthly Security Updates Deliver 245 Patches Oracle has released its June 2026 Critical Security Patch Update to fix vulnerabilities in Communications, EBS, Enterprise Manager and other products.

2026-06-19 02:27 UTC
Patch Tuesday June 2026: Security Updates & CVE Analysis

web:zecurit.com

Get the complete breakdown of Microsoft's June 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

2026-06-19 02:27 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-46032.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/nested.c",
            "arch/x86/kvm/svm/svm.c",
            "arch/x86/kvm/svm/svm.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9a738cf170a4a2332ea3a15e23ec65b5757fe4a1",
              "status": "affected",
              "version": "d82aaef9c88aa27bce63751d6d6329920b1fe8da",
              "versionType": "git"
            },
            {
              "lessThan": "5d291ef0585ed880ed4dd71ea1a5965e0a65fb53",
              "status": "affected",
              "version": "d82aaef9c88aa27bce63751d6d6329920b1fe8da",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/nested.c",
            "arch/x86/kvm/svm/svm.c",
            "arch/x86/kvm/svm/svm.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1-rc1",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT\n\nIf loading L1's CR3 fails on a nested #VMEXIT, nested_svm_vmexit()\nreturns an error code that is ignored by most callers, and continues to\nrun L1 with corrupted state. A sane recovery is not possible in this\ncase, and HW behavior is to cause a shutdown. Inject a triple fault\ninstead, and do not return early from nested_svm_vmexit(). Continue\ncleaning up the vCPU state (e.g. clear pending exceptions), to handle\nthe failure as gracefully as possible.\n\nFrom the APM:\n\n  Upon #VMEXIT, the processor performs the following actions in order to\n  return to the host execution context:\n\n  ...\n\n  if (illegal host state loaded, or exception while loading host state)\n      shutdown\n  else\n      execute first host instruction following the VMRUN\n\nRemove the return value of nested_svm_vmexit(), which is mostly\nunchecked anyway."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T12:56:41.159Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9a738cf170a4a2332ea3a15e23ec65b5757fe4a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d291ef0585ed880ed4dd71ea1a5965e0a65fb53"
        }
      ],
      "title": "KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46032",
    "datePublished": "2026-05-27T12:56:41.159Z",
    "dateReserved": "2026-05-13T15:03:33.093Z",
    "dateUpdated": "2026-05-27T12:56:41.159Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}