Live › vulnerability › CVE-2026-98716
Go to dashboardThe Linux kernel's KVM module on AMD SVM hosts can consult the wrong MSR permission bitmap when a nested guest (L2) is running, because it assumes the bitmap of vmcb02 is always active. The description does not state what an attacker gains or how the mismatch is exploited.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Hosts running the Linux kernel with KVM on AMD SVM that run nested virtualization, where a hypervisor guest runs its own guests. Systems without KVM on AMD or without nested virtualization are unlikely to be affected, but the sources do not confirm this.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted
Use the MSR permission bitmap of the active VMCB instead of assuming that KVM is always using vmcb02's bitmap when L2 is active, as KVM uses msrpm02 if and only if L1 wants to intercept MSR accesses, i.e. if and only if KVM needs to merge msprm01 with msrpm12.
Don't bother tracking the virtual address of the bitmap that's being used, as __va() is cheap on x86, and caching the virtual address would introduce yet another source of potentially stale information.
This page as .md · .json · in your agent: get_signal("CVE-2026-98716")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.