s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

CVE-2026-46059

📛 CVE Title

KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN

⬇ Download JSON ⚠ View as Threat

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN For guests with NRIPS disabled, L1 does not provide NextRIP when running an L2 with an injected soft interrupt, instead it advances the current RIP before running it. KVM uses the current RIP as the NextRIP in vmcb02 to emulate a CPU without NRIPS. However, after L2 runs the first time, NextRIP will be updated by the CPU and/or KVM, and the current RIP is no longer the correct value to use in vmcb02. Hence, after save/restore, use the current RIP if and only if a nested run is pending, otherwise use NextRIP. Give soft_int_next_rip the same treatment, as it's the same logic, just for a narrower use case. [sean: give soft_int_next_rip the same treatment]

Overview

State
PUBLISHED
Assigner (CNA)
Linux
CVSS severity
high
CVSS score
CVSS 7.1 / 10 7.1 7.1 / 10
CVSS vector
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Effective score
7.1 / 10 HIGH source: CNA overview
MSRC score
5.5 / 10 MEDIUM MS rating: Moderate
CWE(s)
—
Reserved
2026-05-13
Published
2026-05-27 12:57 UTC
Last updated
2026-05-27 12:57 UTC
Source
https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46059.json
Linked Threat
CVE-2026-46059 — CVE-2026-46059

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published
2026-05-27 14:17:25 UTC
NVD last modified
2026-06-17 10:52:59 UTC
NVD CVSS v3.1
CVSS 5.5 / 10 5.5 5.5 / 10 MEDIUM source: nvd@nist.gov
NVD CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability subscore
1.8 / 10
Impact subscore
3.6 / 10
EPSS score
0.0012 (probability of exploitation in next 30 days)
EPSS percentile
2.23% vs all CVEs — higher = more likely to be exploited, as of 2026-08-01

NVD / KEV / EPSS data refreshed 2026-08-01 17:11 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID
EUVD-2026-32441
Assigner
Linux
Published
May 27, 2026, 12:57:19 PM
Updated
Jun 14, 2026, 5:51:19 PM
EUVD base score
0.0 / 10
EUVD-reported EPSS
0.1200
Vendors
Linux
Products
Linux (patch: 7.1)
Linux (cc440cdad5b7a4c1de12dace725209eb3e0cf663 <69fe1411a5ce678b4da6489b5d2282b4e1d13acf)
Linux (patch: 6.18.27)
Linux (cc440cdad5b7a4c1de12dace725209eb3e0cf663 <8d397582f6b5e9fbcf09781c7c934b4910e94a50)
Linux (5.8)
Linux (patch: 7.0.4)
Linux (patch: 0)
Linux (cc440cdad5b7a4c1de12dace725209eb3e0cf663 <3428ed1529a1af4cce5aff6c5bd2fcc39ad726bb)
Aliases
GHSA-fhch-vffp-hj8x

ENISA description: In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN For guests with NRIPS disabled, L1 does not provide NextRIP when running an L2 with an injected soft interrupt, instead it advances the current RIP before running it. KVM uses the current RIP as the NextRIP in vmcb02 to emulate a CPU without NRIPS. However, after L2 runs the first time, NextRIP will be updated by the CPU and/or KVM, and the current RIP is no longer the correct value to use in vmcb02. Hence, after save/restore, use the current RIP if and only if a nested run is pending, otherwise use NextRIP. Give soft_int_next_rip the same treatment, as it's the same logic, just for a narrower use case. [sean: give soft_int_next_rip the same treatment]

EUVD references (3)

Microsoft Security Response Center MSRC

Microsoft's vendor-authoritative record from the Security Update Guide — its own CVSS score, impact, severity rating, exploit assessment, and KB-article fixes. Refreshed 2026-08-12 01:09 UTC (source: CVRF).

MS severity
Moderate
MS CVSS base score
5.5 / 10 (temporal 5.5)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release
2026-May

Affected products (2)
VendorProductVersionsPlatforms
Linux Linux cc440cdad5b7a4c1de12dace725209eb3e0cf663 (affected), cc440cdad5b7a4c1de12dace725209eb3e0cf663 (affected), cc440cdad5b7a4c1de12dace725209eb3e0cf663 (affected) —
Linux Linux 5.8 (affected), 0 (unaffected), 6.18.27 (unaffected), 7.0.4 (unaffected), 7.1-rc1 (unaffected) —

Affected products — CPE 2.3 (1) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Vendor references (3)

References embedded in the original CVE record by the assigning CNA.

Web references (7)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

NVD-tagged references (3)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

Remediations (20)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

  • Security Updates - Red Hat Customer Portal
    web:access.redhat.com

    Learn about our open source products, services, and company. You are here

    2026-06-04 00:12 UTC
  • Microsoft and Adobe Patch Tuesday, May 2026 Security Update Review
    web:blog.qualys.com

    May 2026's Patch Tuesday arrives with Microsoft addressing a fresh set of vulnerabilities across its ecosystem, reinforcing the ongoing need for timely patching in an increasingly threat-heavy…

    2026-06-04 00:12 UTC
  • Microsoft Patch Tuesday May 2026 - 120 Vulnerabilities Fixed, Including ...
    web:cybersecuritynews.com

    Microsoft's May 2026 Patch Tuesday lands with a heavy enterprise focus, fixing 120 vulnerabilities across Windows, Office, Azure, developer tools, and Microsoft 365 apps, including 29 remote code execution (RCE) flaws rated Critical.

    2026-06-04 00:12 UTC
  • Security Update Guide - Microsoft
    web:portal.msrc.microsoft.com

    The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

    2026-06-04 00:12 UTC
  • Landing Page | ServiceNow Common Vulnerabilities & Exposures (CVE ...
    web:support.servicenow.com

    Overview The advisories below document publicly disclosed Common Vulnerabilities and Exposures ( CVEs ) in the Now Platform by ServiceNow. Because ServiceNow uses various methods to communicate vulnerability information, patches, and other fixes, customers should review family, security patch , and hotfix release notes, which are available at https://docs.servicenow.com, for a complete list of ...

    2026-06-04 00:12 UTC
  • Microsoft March 2026 Patch Tuesday fixes 2 zero-days, 79 flaws
    web:www.bleepingcomputer.com

    Today is Microsoft's March 2026 Patch Tuesday with security updates for 79 flaws, including 2 publicly disclosed zero-day vulnerabilities.

    2026-06-04 00:12 UTC
  • Oracle's first monthly patch release fixes 35 flaws, including 11 rated ...
    web:www.csoonline.com

    Oracle has released the first security fixes in its new monthly Critical Security Patch Update (CSPU) cycle, designed to address urgent vulnerabilities that can't wait for the company's ...

    2026-06-04 00:12 UTC
  • Grammarly: Free AI Writing Assistance
    web:www.grammarly.com

    Grammarly makes AI writing convenient. Work smarter with personalized AI guidance and text generation on any app or website.

    2026-06-04 00:12 UTC
  • Oracle Critical Patch Update Advisory - April 2026
    web:www.oracle.com

    This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

    2026-06-04 00:12 UTC
  • Patch Tuesday June 2026: Security Updates & CVE Analysis
    web:zecurit.com

    Get the complete breakdown of Microsoft's June 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

    2026-06-04 00:12 UTC
  • CVE-2026-46059 - Vulnerability Details - OpenCVE
    web:app.opencve.io

    No vendor fix or workaround currently provided. OpenCVE Recommended Actions Update the Linux kernel to a version that includes the KVM patch for nested VM run handling Adjust nested virtualization configuration so that NRIPS is enabled or soft interrupts are disabled to avoid the edge case exercised by the bug If an immediate kernel update is not possible, reconfigure host policies to prevent ...

    2026-06-19 02:27 UTC
  • Description of the security update for Microsoft Exchange Server ...
    web:support.microsoft.com

    Note: The fix for CVE - 2026 -45583 is not included in the Security Update, please follow the instructions mentioned in the CVE documentation to address this vulnerability.

    2026-06-19 02:27 UTC
  • CVE-2026-46059 - vulnerability database | Vulners.com
    web:vulners.com

    CVE-2026-46059 (Linux kernel, KVM nSVM) : The issue concerns how NextRIP is chosen for vmcb02 after an L2 VMRUN when NRIPS is disabled. Affected code uses the current RIP as NextRIP to emulate a CPU without NRIPS, but after the first L2 run NextRI...

    2026-06-19 02:27 UTC
  • CVE-2026-46059: KVM AMD Nested Virtualization NextRIP Save/Restore Fix
    web:windowsforum.com

    CVE-2026-46059 is a newly published Linux kernel KVM vulnerability, received by NVD on May 27, 2026 , affecting AMD nested virtualization logic in nSVM when KVM restores an L2 guest after its first VMRUN. It is not yet scored by NVD, and the public record still sits in the frustrating "awaiting...

    2026-06-19 02:27 UTC
  • Home - The Patch Augusta Municipal Golf Course
    web:www.golfthepatch.com

    Now open, The Patch features a redesigned 18-hole course, led by golf course architects Tom Fazio and Beau Welling, and a new 9-hole short course, The Loop at The Patch , designed by Tiger Woods and TGR Design. Welcome to Augusta's best-in-class public golf experience.

    2026-06-19 02:27 UTC
  • CVE-2026-45659 Explained: What the SharePoint RCE Vulnerability Means ...
    web:www.gtconsult.com

    CVE - 2026 -45659 is a SharePoint On-Prem RCE flaw. Learn what it means, who is affected, and how to patch before 14 July 2026 .

    2026-06-19 02:27 UTC
  • Microsoft working on a fix for RoguePlanet, a flaw that grants full PC ...
    web:www.malwarebytes.com

    Microsoft says it's working on a fix for an unpatched Defender vulnerability that can give attackers the highest level of access on Windows.

    2026-06-19 02:27 UTC
  • Oracle Critical Security Patch Update Advisory - May 2026
    web:www.oracle.com

    This Critical Security Patch Update contains 35 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Security Patch Update and other Oracle Software Security Assurance activities is located at May 2026 Critical Security Patch Update: Executive Summary and Analysis.

    2026-06-19 02:27 UTC
  • CVE-2026-46059 | Tenable®
    web:www.tenable.com

    In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN For guests with NRIPS disabled, L1 does not provide NextRIP when running an L2 with an injected soft interrupt, instead it advances the current RIP before running it. KVM uses the current RIP as the NextRIP in vmcb02 to emulate a CPU without NRIPS. However ...

    2026-06-19 02:27 UTC
  • CVE-2026-46059 - Info Vulnerability - TheHackerWire
    web:www.thehackerwire.com

    CVE-2026-46059 is a Info severity vulnerability (CVSS 0). In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first...

    2026-06-19 02:27 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-46059.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/nested.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3428ed1529a1af4cce5aff6c5bd2fcc39ad726bb",
              "status": "affected",
              "version": "cc440cdad5b7a4c1de12dace725209eb3e0cf663",
              "versionType": "git"
            },
            {
              "lessThan": "69fe1411a5ce678b4da6489b5d2282b4e1d13acf",
              "status": "affected",
              "version": "cc440cdad5b7a4c1de12dace725209eb3e0cf663",
              "versionType": "git"
            },
            {
              "lessThan": "8d397582f6b5e9fbcf09781c7c934b4910e94a50",
              "status": "affected",
              "version": "cc440cdad5b7a4c1de12dace725209eb3e0cf663",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/nested.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1-rc1",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN\n\nFor guests with NRIPS disabled, L1 does not provide NextRIP when running\nan L2 with an injected soft interrupt, instead it advances the current RIP\nbefore running it. KVM uses the current RIP as the NextRIP in vmcb02 to\nemulate a CPU without NRIPS.\n\nHowever, after L2 runs the first time, NextRIP will be updated by the CPU\nand/or KVM, and the current RIP is no longer the correct value to use in\nvmcb02.  Hence, after save/restore, use the current RIP if and only if a\nnested run is pending, otherwise use NextRIP.  Give soft_int_next_rip the\nsame treatment, as it's the same logic, just for a narrower use case.\n\n[sean: give soft_int_next_rip the same treatment]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T12:57:19.928Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3428ed1529a1af4cce5aff6c5bd2fcc39ad726bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/69fe1411a5ce678b4da6489b5d2282b4e1d13acf"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d397582f6b5e9fbcf09781c7c934b4910e94a50"
        }
      ],
      "title": "KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46059",
    "datePublished": "2026-05-27T12:57:19.928Z",
    "dateReserved": "2026-05-13T15:03:33.095Z",
    "dateUpdated": "2026-05-27T12:57:19.928Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}