CVE-2026-98716

KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted

Use the MSR permission bitmap of the active VMCB instead of assuming that KVM is always using vmcb02's bitmap when L2 is active, as KVM uses msrpm02 if and only if L1 wants to intercept MSR accesses, i.e. if and only if KVM needs to merge msprm01 with msrpm12.

Don't bother tracking the virtual address of the bitmap that's being used, as __va() is cheap on x86, and caching the virtual address would introduce yet another source of potentially stale information.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b2ac58f90540e39324e7a29a7ad471407ae0bf48 to before 001c78bc64389cabe4f9015ab3942ec9c3592caaAffected b2ac58f90540e39324e7a29a7ad471407ae0bf48 to before 552a110c403f1a61eba0bf71519c6585d9d4242dAffected b2ac58f90540e39324e7a29a7ad471407ae0bf48 to before 0e79ebf6f92a7d15187aede44204fa04b93e474cAffected b2ac58f90540e39324e7a29a7ad471407ae0bf48 to before 84da7a0e92207444d9cbfe69965e17db29008f27Affected b2ac58f90540e39324e7a29a7ad471407ae0bf48 to before 74836ae4785b9754bb36d0b18fcc1dec4e5e98d2Affected b2ac58f90540e39324e7a29a7ad471407ae0bf48 to before 318ef696fa3c712e46bb62a1a828c3cd62f390c3Affected b2ac58f90540e39324e7a29a7ad471407ae0bf48 to before 55865b3ae03705aa39198783b9cb1f8b96eb44e4Affected b2ac58f90540e39324e7a29a7ad471407ae0bf48 to before 9e06bbb9ade7cdf28d4a3b5b14e5812881c8df85Affected f54d0bb8487d2f016fbc4f0e38ef9098f8eb8bd4Affected 89be8950bab799ddb9cc3777345e3c21bcb32dbaAffected 3.16.57 to before 3.17Affected 4.4.168 to before 4.5Affected
LinuxLinux	4.16Affected before 4.16Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.56 through 6.18.Not affected 7.2.10 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

b2ac58f90540e39324e7a29a7ad471407ae0bf48 to before 001c78bc64389cabe4f9015ab3942ec9c3592caaAffected
b2ac58f90540e39324e7a29a7ad471407ae0bf48 to before 552a110c403f1a61eba0bf71519c6585d9d4242dAffected
b2ac58f90540e39324e7a29a7ad471407ae0bf48 to before 0e79ebf6f92a7d15187aede44204fa04b93e474cAffected
b2ac58f90540e39324e7a29a7ad471407ae0bf48 to before 84da7a0e92207444d9cbfe69965e17db29008f27Affected
b2ac58f90540e39324e7a29a7ad471407ae0bf48 to before 74836ae4785b9754bb36d0b18fcc1dec4e5e98d2Affected
b2ac58f90540e39324e7a29a7ad471407ae0bf48 to before 318ef696fa3c712e46bb62a1a828c3cd62f390c3Affected
b2ac58f90540e39324e7a29a7ad471407ae0bf48 to before 55865b3ae03705aa39198783b9cb1f8b96eb44e4Affected
b2ac58f90540e39324e7a29a7ad471407ae0bf48 to before 9e06bbb9ade7cdf28d4a3b5b14e5812881c8df85Affected
f54d0bb8487d2f016fbc4f0e38ef9098f8eb8bd4Affected
89be8950bab799ddb9cc3777345e3c21bcb32dbaAffected
3.16.57 to before 3.17Affected
4.4.168 to before 4.5Affected

LinuxLinux

4.16Affected
before 4.16Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.56 through 6.18.*Not affected
7.2.10 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.