PT-2026-38957 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-15 · CVE-2026-43315

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the KVM nSVM component where a user-triggerable warning occurs in the svm set nested state() function when nested svm load cr3() fails. This condition can be easily triggered from userspace by modifying the CPUID after loading CR3. The KVM ABI allows userspace to set CPUID after SREGS and vice versa, and the system is permissive regarding guest CPUID, making the warning unnecessary as it provides no meaningful protection for the kernel or benefit to the user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-43315

Affected Products

Linux Kernel

References · 18

• https://git.kernel.org/stable/c/ce904c8a5bbe697eae0f7e34b07095bd7a6dee19 · Patch
• https://git.kernel.org/stable/c/969e5e13ff5c18603f21d1f9f64ec9194e141ac0 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43315 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43315 · Security Note
• https://git.kernel.org/stable/c/580ea57840864d40e019bc13fd26afdc8d510a2f · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-43315 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43315 · Vendor Advisory
• https://git.kernel.org/stable/c/deb8f6dfd31d94b18dbeeaa8c01fbec5fc70fd2b · Patch
• https://ubuntu.com/security/CVE-2026-43315 · Vendor Advisory
• https://git.kernel.org/stable/c/fc3ba56385d03501eb582e4b86691ba378e556f9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43315 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43315 · Vendor Advisory
• https://git.kernel.org/stable/c/155ec243ef726f4bc49536fa0bfb565dc011ab17 · Patch
• https://git.kernel.org/stable/c/ebb2ab4f1c87d6b52776292cf7dc16aea48e95f8 · Patch
• https://docs.bell-sw.com/security/cves/CVE-2026-43315 · Note