CVE-2026-43133 json
KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
published 2026-05-06 6 mo ago modified 2026-10-19 20 d ago also EUVD-2026-27695
- cvss
- 7.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 2%
- public exploits
- 0
- none known
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
Commit cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload of guest state") made KVM always use vmcb01 for the fields controlled by VMSAVE/VMLOAD, but it missed updating the VMLOAD/VMSAVE emulation code to always use vmcb01.
As a result, if VMSAVE/VMLOAD is executed by an L2 guest and is not intercepted by L1, KVM will mistakenly use vmcb02. Always use vmcb01 instead of the current VMCB.
Patch / fix
- Linux Linux 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, 7.0
- Red Hat Red Hat Enterprise Linux 10 0:6.12.0-211.53.1.el10_2
- Red Hat Red Hat Enterprise Linux 9 0:5.14.0-687.46.1.el9_8
- linux Debian 12 6.1.170-1
- linux Debian 13 6.12.85-1
- linux Debian 14 6.19.6-1
debian advisories DEBIAN-CVE-2026-43133
- linux Ubuntu 22.04 LTS 5.15.0-186.196
- linux Ubuntu 24.04 LTS 6.8.0-134.134
- linux-aws Ubuntu 22.04 LTS 5.15.0-1112.119
- linux-aws Ubuntu 24.04 LTS 6.8.0-1060.63
- linux-gcp Ubuntu 22.04 LTS 5.15.0-1112.122
- linux-gcp Ubuntu 24.04 LTS 6.8.0-1063.69
- linux-gke Ubuntu 22.04 LTS 5.15.0-1108.114
- linux-gke Ubuntu 24.04 LTS 6.8.0-1058.64
ubuntu advisories UBUNTU-CVE-2026-43133
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- kernel-rt RHEL 8 4.18.0-553.163.1.rt7.504.el8_10
- kernel-rt-kvm RHEL 8 4.18.0-553.163.1.rt7.504.el8_10
- kernel-rt-core RHEL 8 4.18.0-553.163.1.rt7.504.el8_10
- kernel-rt-modules RHEL 8 4.18.0-553.163.1.rt7.504.el8_10
- kernel-rt-debug-kvm RHEL 8 4.18.0-553.163.1.rt7.504.el8_10
- kernel-rt-debug-core RHEL 8 4.18.0-553.163.1.rt7.504.el8_10
- kernel-rt-debug-modules RHEL 8 4.18.0-553.163.1.rt7.504.el8_10
- kernel-rt-modules-extra RHEL 8 4.18.0-553.163.1.rt7.504.el8_10
red hat advisories RHSA-2026:67469RHSA-2026:67468RHSA-2026:66180RHSA-2026:65334
- kernel-source Linux Micro 6.1, Linux Micro 6.0 6.4.0-51.1
- kernel-default Linux Micro 6.1, Linux Micro 6.0 6.4.0-51.1
- kernel-kvmsmall Linux Micro 6.1, Linux Micro 6.0 6.4.0-51.1
- kernel-rt Linux Micro 6.1, Linux Micro 6.0 6.4.0-51.1
- kernel-source-rt Linux Micro 6.1, Linux Micro 6.0 6.4.0-51.1
- kernel-default SLES 16.0, SLE High Availability Extension 16.0, Linux Micro 6.2 +1 more 6.12.0-160000.37.1
- kernel-rt Linux Micro 6.2 6.12.0-160000.37.1
- kernel-64kb SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.37.1
suse advisories SUSE-SU-2026:23244-1SUSE-SU-2026:23241-1SUSE-SU-2026:23194-1SUSE-SU-2026:23193-1SUSE-SU-2026:23237-1SUSE-SU-2026:23068-1
- kernel-rt openSUSE Leap 16.0 6.12.0-160000.37.1
- dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.37.1
- kernel-64kb openSUSE Leap 16.0 6.12.0-160000.37.1
- kernel-syms openSUSE Leap 16.0 6.12.0-160000.37.1
- kernel-azure openSUSE Leap 16.0 6.12.0-160000.37.1
- kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.37.1
- kernel-source openSUSE Leap 16.0 6.12.0-160000.37.1
- kernel-default openSUSE Leap 16.0 6.12.0-160000.37.1
opensuse advisories openSUSE-SU-2026:21555-1
- kernel AlmaLinux 8 4.18.0-553.163.1.el8_10
- perf AlmaLinux 8 4.18.0-553.163.1.el8_10
- bpftool AlmaLinux 8 4.18.0-553.163.1.el8_10
- kernel-core AlmaLinux 8 4.18.0-553.163.1.el8_10
- kernel-tools AlmaLinux 8 4.18.0-553.163.1.el8_10
- python3-perf AlmaLinux 8 4.18.0-553.163.1.el8_10
- kernel-modules AlmaLinux 8 4.18.0-553.163.1.el8_10
- kernel-zfcpdump AlmaLinux 8 4.18.0-553.163.1.el8_10
almalinux advisories ALSA-2026:67468ALSA-2026:67469ALSA-2026:66180ALSA-2026:65334
- kernel-rt Rocky Linux 8 4.18.0-553.163.1.rt7.504.el8_10
- kernel Rocky Linux 8 4.18.0-553.163.1.el8_10
- kernel Rocky Linux 9 5.14.0-687.46.1.el9_8
- kernel Rocky Linux 10 6.12.0-211.53.1.el10_2
rocky linux advisories RLSA-2026:67469RLSA-2026:67468RLSA-2026:66180RLSA-2026:65334
- git.kernel.org/stable/c/10063e1251c1485034a018236080792ad083dcc5 commit
- git.kernel.org/stable/c/c3b7015000988ba35ecd5648f4b2283960f00543 commit
- git.kernel.org/stable/c/3880e331b0b31d0d5d3702b124f6c93539cd478a commit
- git.kernel.org/stable/c/fce2fd4a2ca05670a91015aacccf96a1c26268fd commit
- git.kernel.org/stable/c/d464cf1ed900d47c85393d40b00017b6adfc2e6c commit
- git.kernel.org/stable/c/0004ecb798b30e90d7ebfe74efae2d9423315a64 commit
- git.kernel.org/stable/c/127ccae2c185f62e6ecb4bf24f9cb307e9b9c619 commit
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-43133 updated cvss 7.9
kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
-
Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 more Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8affected: workaround, no fix available
-
Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-687.46.1.el9_8, perf 5.14.0-687.46.1.el9_8, rtla 5.14.0-687.46.1.el9_8, python3-perf 5.14.0-687.46.1.el9_8, kernel-devel-matched 5.14.0-687.46.1.el9_8, kernel-64k-devel-matched 5.14.0-687.46.1.el9_8, +7 morefixed: vendor fix RHSA-2026:66180
-
Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-211.53.1.el10_2, perf 6.12.0-211.53.1.el10_2, rtla 6.12.0-211.53.1.el10_2, python3-perf 6.12.0-211.53.1.el10_2, kernel-devel-matched 6.12.0-211.53.1.el10_2, kernel-64k-devel-matched 6.12.0-211.53.1.el10_2, +7 morefixed: vendor fix RHSA-2026:65334
-
Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-553.163.1.el8_10, kernel 4.18.0-553.163.1.el8_10, bpftool 4.18.0-553.163.1.el8_10, kernel-core 4.18.0-553.163.1.el8_10, kernel-tools 4.18.0-553.163.1.el8_10, python3-perf 4.18.0-553.163.1.el8_10, +15 morefixed: vendor fix RHSA-2026:67468
-
Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-687.46.1.el9_8, kernel-64k 5.14.0-687.46.1.el9_8, kernel-core 5.14.0-687.46.1.el9_8, kernel-tools 5.14.0-687.46.1.el9_8, kernel-modules 5.14.0-687.46.1.el9_8, kernel-64k-core 5.14.0-687.46.1.el9_8, +27 morefixed: vendor fix RHSA-2026:66180
-
Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-211.53.1.el10_2, kernel-64k 6.12.0-211.53.1.el10_2, kernel-core 6.12.0-211.53.1.el10_2, kernel-tools 6.12.0-211.53.1.el10_2, kernel-modules 6.12.0-211.53.1.el10_2, kernel-64k-core 6.12.0-211.53.1.el10_2, +28 morefixed: vendor fix RHSA-2026:65334
-
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-687.46.1.el9_8, kernel-debuginfo-common-s390x 5.14.0-687.46.1.el9_8, kernel-debuginfo-common-x86_64 5.14.0-687.46.1.el9_8, kernel-debuginfo-common-aarch64 5.14.0-687.46.1.el9_8, kernel-debuginfo-common-ppc64le 5.14.0-687.46.1.el9_8fixed: vendor fix RHSA-2026:66180
-
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-211.53.1.el10_2, kernel-debuginfo-common-s390x 6.12.0-211.53.1.el10_2, kernel-debuginfo-common-x86_64 6.12.0-211.53.1.el10_2, kernel-debuginfo-common-aarch64 6.12.0-211.53.1.el10_2, kernel-debuginfo-common-ppc64le 6.12.0-211.53.1.el10_2fixed: vendor fix RHSA-2026:65334
show 9 moreshow fewer
-
Red Hat Enterprise Linux CRB (v. 8) kernel-debuginfo-common-x86_64 4.18.0-553.163.1.el8_10, kernel-debuginfo-common-aarch64 4.18.0-553.163.1.el8_10, kernel-debuginfo-common-ppc64le 4.18.0-553.163.1.el8_10fixed: vendor fix RHSA-2026:67468
-
Red Hat Enterprise Linux NFV (v. 8) kernel-rt 4.18.0-553.163.1.rt7.504.el8_10, kernel-rt-kvm 4.18.0-553.163.1.rt7.504.el8_10, kernel-rt-core 4.18.0-553.163.1.rt7.504.el8_10, kernel-rt-modules 4.18.0-553.163.1.rt7.504.el8_10, kernel-rt-debug-kvm 4.18.0-553.163.1.rt7.504.el8_10, kernel-rt-debug-core 4.18.0-553.163.1.rt7.504.el8_10, +4 morefixed: vendor fix RHSA-2026:67469
-
Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-687.46.1.el9_8, kernel-rt-64k 5.14.0-687.46.1.el9_8, kernel-rt-core 5.14.0-687.46.1.el9_8, kernel-rt-modules 5.14.0-687.46.1.el9_8, kernel-rt-64k-core 5.14.0-687.46.1.el9_8, kernel-rt-debug-core 5.14.0-687.46.1.el9_8, +14 morefixed: vendor fix RHSA-2026:66180
-
Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-211.53.1.el10_2, kernel-rt-64k 6.12.0-211.53.1.el10_2, kernel-rt-core 6.12.0-211.53.1.el10_2, kernel-rt-modules 6.12.0-211.53.1.el10_2, kernel-rt-64k-core 6.12.0-211.53.1.el10_2, kernel-rt-debug-core 6.12.0-211.53.1.el10_2, +14 morefixed: vendor fix RHSA-2026:65334
-
Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-687.46.1.el9_8, kernel-rt-core 5.14.0-687.46.1.el9_8, kernel-rt-modules 5.14.0-687.46.1.el9_8, kernel-rt-debug-core 5.14.0-687.46.1.el9_8, kernel-rt-modules-core 5.14.0-687.46.1.el9_8, kernel-rt-debug-modules 5.14.0-687.46.1.el9_8, +4 morefixed: vendor fix RHSA-2026:66180
-
Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-211.53.1.el10_2, kernel-rt-core 6.12.0-211.53.1.el10_2, kernel-rt-modules 6.12.0-211.53.1.el10_2, kernel-rt-debug-core 6.12.0-211.53.1.el10_2, kernel-rt-modules-core 6.12.0-211.53.1.el10_2, kernel-rt-debug-modules 6.12.0-211.53.1.el10_2, +4 morefixed: vendor fix RHSA-2026:65334
-
Red Hat Enterprise Linux RT (v. 8) kernel-rt 4.18.0-553.163.1.rt7.504.el8_10, kernel-rt-core 4.18.0-553.163.1.rt7.504.el8_10, kernel-rt-modules 4.18.0-553.163.1.rt7.504.el8_10, kernel-rt-debug-core 4.18.0-553.163.1.rt7.504.el8_10, kernel-rt-debug-modules 4.18.0-553.163.1.rt7.504.el8_10, kernel-rt-modules-extra 4.18.0-553.163.1.rt7.504.el8_10, +2 morefixed: vendor fix RHSA-2026:67469
-
Red Hat OpenShift Container Platform 4.22 rhcos 4.22.9.8.202609081748fixed: vendor fix RHSA-2026:66357
-
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 10 libkrunnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 24 d ago
Exploit prediction
0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.9 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H |
| CISA ADP | 3.1 | 7.9 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H |
Affected products
- Linux Linux
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat OpenShift Container Platform 4
Classification
- Weakness
- Technology feeds
References
-
git.kernel.org
/stable/c/10063e1251c1485034a018236080792ad083dcc5
patch
-
git.kernel.org
/stable/c/c3b7015000988ba35ecd5648f4b2283960f00543
patch
-
git.kernel.org
/stable/c/3880e331b0b31d0d5d3702b124f6c93539cd478a
patch
-
git.kernel.org
/stable/c/fce2fd4a2ca05670a91015aacccf96a1c26268fd
patch
-
git.kernel.org
/stable/c/d464cf1ed900d47c85393d40b00017b6adfc2e6c
patch
-
git.kernel.org
/stable/c/0004ecb798b30e90d7ebfe74efae2d9423315a64
patch
-
git.kernel.org
/stable/c/127ccae2c185f62e6ecb4bf24f9cb307e9b9c619
patch
-
access.redhat.com
/errata/RHSA-2026:66357
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:65334
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:66180
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:67468
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:67469
vendor-advisory
-
access.redhat.com
/security/cve/CVE-2026-43133
vdb-entry
-
bugzilla.redhat.com
/show_bug.cgi?id=2467065
issue-tracking
- security.access.redhat.com /data/csaf/v2/vex/2026/cve-2026-43133.json
Sources
- CVE List CVE-2026-43133
- NVD CVE-2026-43133
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.