Riskcovery

CVE-2026-46131

KVM: x86: check for nEPT/nNPT in slow flush hypercalls

State
Published
Severity
Not scored
Published
May 28, 2026
Updated
Jun 14, 2026
Reserved
May 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: check for nEPT/nNPT in slow flush hypercalls

Checking is_guest_mode(vcpu) is incorrect, because translate_nested_gpa() is only valid if an L2 guest is running *with nested EPT/NPT enabled*. Instead use the same condition as translate_nested_gpa() itself.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • aee738236dca0d0870789138ec494e15d6303566 to before 971f17f5d91045404e3914029ea57c3da90179a4Affected
  • aee738236dca0d0870789138ec494e15d6303566 to before 45fc766bc756ff1d66f8ca026a9c4f7f764adfaeAffected
  • aee738236dca0d0870789138ec494e15d6303566 to before d6f4e217d663ede5becc2fd6cb612c749677387bAffected
  • aee738236dca0d0870789138ec494e15d6303566 to before 4c7f8436b19a2a3acc0cb6b6e3becd6796ae5c57Affected
  • aee738236dca0d0870789138ec494e15d6303566 to before 464af6fc2b1dcc74005b7f58ee3812b17777efeeAffected
LinuxLinux
  • 6.2Affected
  • before 6.2Not affected
  • 6.6.140 through 6.6.*Not affected
  • 6.12.88 through 6.12.*Not affected
  • 6.18.30 through 6.18.*Not affected
  • 7.0.7 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.