CVE-2026-46295

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46295", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.110Z", "datePublished": "2026-06-08T15:46:22.494Z", "dateUpdated": "2026-06-14T18:07:10.912Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-14T18:07:10.912Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty\n\nFall back to apic_find_highest_vector() when PID.ON is set but PIR\nturns out to be empty, to correctly report the highest pending interrupt\nfrom the existing IRR.\n\nIn a nested VM stress test, the following WARNING fires in\nvmx_check_nested_events() when kvm_cpu_has_interrupt() reports a pending\ninterrupt but the subsequent kvm_apic_has_interrupt() (which invokes\nvmx_sync_pir_to_irr() again) returns -1:\n\n WARNING: CPU: 99 PID: 57767 at arch/x86/kvm/vmx/nested.c:4449 vmx_check_nested_events+0x6bf/0x6e0 [kvm_intel]\n Call Trace:\n kvm_check_and_inject_events\n vcpu_enter_guest.constprop.0\n vcpu_run\n kvm_arch_vcpu_ioctl_run\n kvm_vcpu_ioctl\n __x64_sys_ioctl\n do_syscall_64\n entry_SYSCALL_64_after_hwframe\n\nThe root cause is a race between vmx_sync_pir_to_irr() on the target vCPU\nand __vmx_deliver_posted_interrupt() on a sender vCPU. The sender\nperforms two individually-atomic operations that are not a single\ntransaction:\n\n 1. pi_test_and_set_pir(vector) -- sets the PIR bit\n 2. pi_test_and_set_on() -- sets PID.ON\n\nThe following interleaving triggers the bug:\n\n Sender vCPU (IPI): Target vCPU (1st sync_pir_to_irr):\n B1: set PIR[vector]\n A1: pi_clear_on()\n A2: pi_harvest_pir() -> sees B1 bit\n A3: xchg() -> consumes bit, PIR=0\n (1st sync returns correct max_irr)\n B2: set PID.ON = 1\n\n Target vCPU (2nd sync_pir_to_irr):\n C1: pi_test_on() -> TRUE (from B2)\n C2: pi_clear_on() -> ON=0\n C3: pi_harvest_pir() -> PIR empty\n C4: *max_irr = -1, early return\n IRR NOT SCANNED\n\nThe interrupt is not lost (it resides in the IRR from the first sync and\nis recovered on the next vcpu_enter_guest() iteration), but the incorrect\nmax_irr causes a spurious WARNING and a wasted L2 VM-Enter/VM-Exit cycle."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/lapic.c"], "versions": [{"version": "b41f8638b9d30fbe045b4ef83ff4136c56a57397", "lessThan": "bb1703949dcaa9a49c338dee075f659f4634214d", "status": "affected", "versionType": "git"}, {"version": "b41f8638b9d30fbe045b4ef83ff4136c56a57397", "lessThan": "4b6b06a8b12bfd95f9015074b1430c1480908073", "status": "affected", "versionType": "git"}, {"version": "b41f8638b9d30fbe045b4ef83ff4136c56a57397", "lessThan": "33fd0ccd2590b470b65adcca288615ad3b5e3e06", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/lapic.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.30", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.7", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.30"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.0.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bb1703949dcaa9a49c338dee075f659f4634214d"}, {"url": "https://git.kernel.org/stable/c/4b6b06a8b12bfd95f9015074b1430c1480908073"}, {"url": "https://git.kernel.org/stable/c/33fd0ccd2590b470b65adcca288615ad3b5e3e06"}], "title": "KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/x86/kvm/lapic.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bb1703949dcaa9a49c338dee075f659f4634214d", "status": "affected", "version": "b41f8638b9d30fbe045b4ef83ff4136c56a57397", "versionType": "git"}, {"lessThan": "4b6b06a8b12bfd95f9015074b1430c1480908073", "status": "affected", "version": "b41f8638b9d30fbe045b4ef83ff4136c56a57397", "versionType": "git"}, {"lessThan": "33fd0ccd2590b470b65adcca288615ad3b5e3e06", "status": "affected", "version": "b41f8638b9d30fbe045b4ef83ff4136c56a57397", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/x86/kvm/lapic.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.30", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0C6ED95F-C349-4582-8D0B-43787F134EDA", "versionEndExcluding": "6.18.30", "versionStartIncluding": "6.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E", "versionEndExcluding": "7.0.7", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty\n\nFall back to apic_find_highest_vector() when PID.ON is set but PIR\nturns out to be empty, to correctly report the highest pending interrupt\nfrom the existing IRR.\n\nIn a nested VM stress test, the following WARNING fires in\nvmx_check_nested_events() when kvm_cpu_has_interrupt() reports a pending\ninterrupt but the subsequent kvm_apic_has_interrupt() (which invokes\nvmx_sync_pir_to_irr() again) returns -1:\n\n WARNING: CPU: 99 PID: 57767 at arch/x86/kvm/vmx/nested.c:4449 vmx_check_nested_events+0x6bf/0x6e0 [kvm_intel]\n Call Trace:\n kvm_check_and_inject_events\n vcpu_enter_guest.constprop.0\n vcpu_run\n kvm_arch_vcpu_ioctl_run\n kvm_vcpu_ioctl\n __x64_sys_ioctl\n do_syscall_64\n entry_SYSCALL_64_after_hwframe\n\nThe root cause is a race between vmx_sync_pir_to_irr() on the target vCPU\nand __vmx_deliver_posted_interrupt() on a sender vCPU. The sender\nperforms two individually-atomic operations that are not a single\ntransaction:\n\n 1. pi_test_and_set_pir(vector) -- sets the PIR bit\n 2. pi_test_and_set_on() -- sets PID.ON\n\nThe following interleaving triggers the bug:\n\n Sender vCPU (IPI): Target vCPU (1st sync_pir_to_irr):\n B1: set PIR[vector]\n A1: pi_clear_on()\n A2: pi_harvest_pir() -> sees B1 bit\n A3: xchg() -> consumes bit, PIR=0\n (1st sync returns correct max_irr)\n B2: set PID.ON = 1\n\n Target vCPU (2nd sync_pir_to_irr):\n C1: pi_test_on() -> TRUE (from B2)\n C2: pi_clear_on() -> ON=0\n C3: pi_harvest_pir() -> PIR empty\n C4: *max_irr = -1, early return\n IRR NOT SCANNED\n\nThe interrupt is not lost (it resides in the IRR from the first sync and\nis recovered on the next vcpu_enter_guest() iteration), but the incorrect\nmax_irr causes a spurious WARNING and a wasted L2 VM-Enter/VM-Exit cycle."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nKVM: x86: Realizar escaneo IRR en __kvm_apic_update_irr incluso si PIR est\u00e1 vac\u00edo\n\nRecurrir a apic_find_highest_vector() cuando PID.ON est\u00e1 establecido pero PIR resulta estar vac\u00edo, para reportar correctamente la interrupci\u00f3n pendiente m\u00e1s alta del IRR existente.\n\nEn una prueba de estr\u00e9s de VM anidada, la siguiente ADVERTENCIA se activa en vmx_check_nested_events() cuando kvm_cpu_has_interrupt() reporta una interrupci\u00f3n pendiente pero la subsiguiente kvm_apic_has_interrupt() (que invoca vmx_sync_pir_to_irr() de nuevo) devuelve -1:\n\n ADVERTENCIA: CPU: 99 PID: 57767 en arch/x86/kvm/vmx/nested.c:4449 vmx_check_nested_events+0x6bf/0x6e0 [kvm_intel]\n Traza de Llamada:\n kvm_check_and_inject_events\n vcpu_enter_guest.constprop.0\n vcpu_run\n kvm_arch_vcpu_ioctl_run\n kvm_vcpu_ioctl\n __x64_sys_ioctl\n do_syscall_64\n entry_SYSCALL_64_after_hwframe\n\nLa causa ra\u00edz es una condici\u00f3n de carrera entre vmx_sync_pir_to_irr() en la vCPU objetivo y __vmx_deliver_posted_interrupt() en una vCPU remitente. El remitente realiza dos operaciones individualmente at\u00f3micas que no son una \u00fanica transacci\u00f3n:\n\n 1. pi_test_and_set_pir(vector) -- establece el bit PIR\n 2. pi_test_and_set_on() -- establece PID.ON\n\nEl siguiente entrelazado desencadena el error:\n\n vCPU remitente (IPI): vCPU objetivo (1\u00aa sync_pir_to_irr):\n B1: establecer PIR[vector]\n A1: pi_clear_on()\n A2: pi_harvest_pir() -> ve el bit B1\n A3: xchg() -> consume el bit, PIR=0\n (la 1\u00aa sincronizaci\u00f3n devuelve el max_irr correcto)\n B2: establecer PID.ON = 1\n\n vCPU objetivo (2\u00aa sync_pir_to_irr):\n C1: pi_test_on() -> VERDADERO (de B2)\n C2: pi_clear_on() -> ON=0\n C3: pi_harvest_pir() -> PIR vac\u00edo\n C4: max_irr = -1, retorno anticipado\n IRR NO ESCANEADO\n\nLa interrupci\u00f3n no se pierde (reside en el IRR de la primera sincronizaci\u00f3n y se recupera en la siguiente iteraci\u00f3n de vcpu_enter_guest()), pero el max_irr incorrecto causa una ADVERTENCIA espuria y un ciclo de VM-Enter/VM-Exit de L2 desperdiciado."}], "id": "CVE-2026-46295", "lastModified": "2026-07-23T08:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-06-08T17:16:47.913", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/33fd0ccd2590b470b65adcca288615ad3b5e3e06"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4b6b06a8b12bfd95f9015074b1430c1480908073"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bb1703949dcaa9a49c338dee075f659f4634214d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty", "id": "2486435", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486435"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-821", "details": ["A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) component. A race condition in the Advanced Programmable Interrupt Controller (APIC) interrupt handling can lead to an incorrect state during interrupt synchronization. This issue, occurring between a sender and target virtual CPU (vCPU), results in a spurious warning and inefficient processing of virtual machine (VM) entry and exit cycles. While interrupts are not lost, this can cause performance degradation and unnecessary resource consumption within a virtualized environment."], "name": "CVE-2026-46295", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46295\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46295\nhttps://lore.kernel.org/linux-cve-announce/2026060858-CVE-2026-46295-a5d0@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b41f8638b9d30fbe045b4ef83ff4136c56a57397,bb1703949dcaa9a49c338dee075f659f4634214d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b41f8638b9d30fbe045b4ef83ff4136c56a57397,4b6b06a8b12bfd95f9015074b1430c1480908073)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b41f8638b9d30fbe045b4ef83ff4136c56a57397,33fd0ccd2590b470b65adcca288615ad3b5e3e06)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.30,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.7,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-08T19:00:12.642677+00:00", "updated": "2026-08-13T20:45:02.482447+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}