SECUFOCUSNOW
Home›CVE index›CVE-2026-43133
Review reviewHigh

CVE-2026-43133

Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation Commit cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload of guest state") made KVM always use vmcb01 for the fields controlled by VMSAVE/VMLOAD, but it missed updating the VMLOAD/VMSAVE emulation code to always use vmcb01. As a result, if VMSAVE/VMLOAD is executed by an L2 guest and is not intercepted by L1, KVM will mistakenly use vmcb02. Always use vmcb01 instead of the current VMCB.

CVSS
7.9
EPSS
0.13%
2.81% percentile
CISA KEV
Not listed
Published
2026.05.06
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.13%
Technical severityCVSS 7.9

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation Commit cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload of guest state") made KVM always use vmcb01 for the fields controlled by VMSAVE/VMLOAD, but it missed updating the VMLOAD/VMSAVE emulation code to always use vmcb01. As a result, if VMSAVE/VMLOAD is executed by an L2 guest and is not intercepted by L1, KVM will mistakenly use vmcb02. Always use vmcb01 instead of the current VMCB.

Affected product and versions

Product
Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6
Affected versions
>= cc3ed80ae69f454c3d904af9f65394a540099723 < 10063e1251c1485034a018236080792ad083dcc5, >= cc3ed80ae69f454c3d904af9f65394a540099723 < c3b7015000988ba35ecd5648f4b2283960f00543, >= cc3ed80ae69f454c3d904af9f65394a540099723 < 3880e331b0b31d0d5d3702b124f6c93539cd478a, >= cc3ed80ae69f454c3d904af9f65394a540099723 < fce2fd4a2ca05670a91015aacccf96a1c26268fd, >= cc3ed80ae69f454c3d904af9f65394a540099723 < d464cf1ed900d47c85393d40b00017b6adfc2e6c, >= cc3ed80ae69f454c3d904af9f65394a540099723 < 0004ecb798b30e90d7ebfe74efae2d9423315a64, >= cc3ed80ae69f454c3d904af9f65394a540099723 < 127ccae2c185f62e6ecb4bf24f9cb307e9b9c619, >= 5.13, >= 5.13 < 5.15.202, >= 5.16 < 6.1.165, >= 6.2 < 6.6.128, >= 6.7 < 6.12.75, >= 6.13 < 6.18.16, >= 6.19 < 6.19.6
Fixed versions
5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6 and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
CWE
CWE-628
CVE-2026-43133 — Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6 | SECUFOCUS NOW