CVE-2026-98716
Description
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for AMD processors (SVM). During nested virtualization, KVM incorrectly checked whether Model-Specific Register (MSR) accesses were intercepted by referencing the wrong control structure's permission bitmap. A malicious guest could exploit this behavior to bypass register interception controls, potentially leading to unauthorized hardware state manipulation or a denial of service (DoS).
Statement
This vulnerability is rated as Important because an attacker operating within a nested virtual machine can circumvent register interception boundaries, leading to potential hypervisor compromise or host denial of service. The risk qualifies for this severity rating due to the cross-boundary escape potential from an unprivileged guest into the host kernel environment. Exploitation is strictly constrained to AMD hardware platforms configured to run nested KVM virtualization, meaning Intel-based deployments and hypervisors operating without nested virtualization enabled remain unaffected.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Changed | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
A user can assume the identity of another user with separate privileges in another context. This will give the user unauthorized access that may allow them to acquire the access information of other users.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
