Linux Kernel KVM CVE-2026-43133

Upgrade to patched Linux kernel versions: 5.15.202+ for 5.15.x series, 6.1.165+ for 6.1.x, 6.6.128+ for 6.6.x, 6.12.75+ for 6.12.x, 6.18.16+ for 6.18.x, 6.19.6+ for 6.19.x, or 7.0+ for mainline kernels. Patches are available from kernel.org stable repositories via commits 10063e1251c1485034a018236080792ad083dcc5, c3b7015000988ba35ecd5648f4b2283960f00543, 3880e331b0b31d0d5d3702b124f6c93539cd478a, fce2fd4a2ca05670a91015aacccf96a1c26268fd, d464cf1ed900d47c85393d40b00017b6adfc2e6c, 0004ecb798b30e90d7ebfe74efae2d9423315a64, and 127ccae2c185f62e6ecb4bf24f9cb307e9b9c619. If immediate patching is not feasible, disable nested virtualization on AMD-based KVM hosts by setting the kvm_amd module parameter nested=0 (add 'options kvm_amd nested=0' to /etc/modprobe.d/kvm.conf and reload the module or reboot). This workaround prevents L1 guests from running their own nested guests, which may break legitimate use cases in development or testing environments but eliminates the attack surface. Alternatively, configure L1 hypervisors to always intercept VMLOAD/VMSAVE instructions from L2 guests, though this requires L1 hypervisor configuration changes and may impact performance. For multi-tenant cloud environments, prioritize patching hosts running untrusted nested workloads.