CVE-2026-46131

KVM: x86: check for nEPT/nNPT in slow flush hypercalls

MEDIUM

5.5

CVSS Score

Published: May 28, 2026 at 09:35 AM UTC

Updated: June 27, 2026 at 11:41 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: check for nEPT/nNPT in slow flush hypercalls Checking is_guest_mode(vcpu) is incorrect, because translate_nested_gpa() is only valid if an L2 guest is running *with nested EPT/NPT enabled*. Instead use the same condition as translate_nested_gpa() itself.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

6.13 ≤ v < 6.18.306.19 ≤ v < 7.0.76.2 ≤ v < 6.12.886.2 ≤ v < 6.18.306.2 ≤ v < 6.6.1406.2 ≤ v < 7.0.76.2 ≤ v < 7.16.7 ≤ v < 6.12.887.1 rc1 7.1 rc2aee738236dca0d0870789138ec494e15d6303566

Vendor states this is fixed in 45fc766bc756ff1d66f8ca026a9c4f7f764adfae (fixed)

Vendor states this is fixed in 464af6fc2b1dcc74005b7f58ee3812b17777efee (fixed)

Vendor states this is fixed in 4c7f8436b19a2a3acc0cb6b6e3becd6796ae5c57 (fixed)

Vendor states this is fixed in 971f17f5d91045404e3914029ea57c3da90179a4 (fixed)

Vendor states this is fixed in d6f4e217d663ede5becc2fd6cb612c749677387b (fixed)

Vendor states this is fixed in 6.12.88 (unaffected)

Vendor states this is fixed in 6.18.30 (unaffected)

Vendor states this is fixed in 6.2 (unaffected)

Vendor states this is fixed in 6.6.140 (unaffected)

Vendor states this is fixed in 7.0.7 (unaffected)

Vendor states this is fixed in 7.1 (unaffected)