CVE-2026-46295

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty

Fall back to apic_find_highest_vector() when PID.ON is set but PIR

turns out to be empty, to correctly report the highest pending interrupt

from the existing IRR.

In a nested VM stress test, the following WARNING fires in

vmx_check_nested_events() when kvm_cpu_has_interrupt() reports a pending

interrupt but the subsequent kvm_apic_has_interrupt() (which invokes

vmx_sync_pir_to_irr() again) returns -1:

WARNING: CPU: 99 PID: 57767 at arch/x86/kvm/vmx/nested.c:4449 vmx_check_nested_events+0x6bf/0x6e0 [kvm_intel]

Call Trace:

kvm_check_and_inject_events

vcpu_enter_guest.constprop.0

vcpu_run

kvm_arch_vcpu_ioctl_run

kvm_vcpu_ioctl

__x64_sys_ioctl

do_syscall_64

entry_SYSCALL_64_after_hwframe

The root cause is a race between vmx_sync_pir_to_irr() on the target vCPU

and __vmx_deliver_posted_interrupt() on a sender vCPU. The send

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References