Skip to main content

Linux Kernel CVE-2026-46174

| EUVDEUVD-2026-32801 HIGH
2026-05-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-xgq6-gg2m-2x7g
Information Disclosure Linux Amd
8.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain low-privileged local execution on Zen2 host
  2. Delivery
    Schedule attacker thread on SMT sibling of victim
  3. Exploit
    Pollute or probe shared op cache entries
  4. Execution
    Trigger instruction corruption or leakage in victim domain
  5. Persist
    Cross security boundary (scope change)
  6. Impact
    Escalate privileges or extract sensitive data

Vulnerability Assessment

Exploitation Conditions

Requires local code execution with at least low-privilege user access (PR:L) on a host running the Linux kernel atop an AMD Zen2 CPU (e.g., Ryzen 3000, EPYC 7002 Rome, Threadripper 3000) - non-Zen2 AMD parts (Zen, Zen+, Zen3, Zen4) and all Intel CPUs are not in scope. No user interaction is required (UI:N), and the attack does not require network access. Practical exploitation is most realistic when SMT is enabled and the attacker's thread can co-reside on the same physical core as a higher-privilege victim (kernel thread, another VM, or hypervisor); disabling SMT or enforcing strict core pinning materially limits the attack surface. The bug is in op-cache resource isolation, so kernel versions prior to the fixed releases (5.10.256, 5.15.207, 6.1.173, 6.6.139, 6.12.88, 6.18.30, 7.0.7) remain exposed regardless of distro.
Impact

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H signals a local, low-complexity attack by a low-privileged user with scope change - meaning an unprivileged process on a Zen2 host could affect other security domains (e.g., other VMs, the hypervisor, or kernel space), which is what drives the 8.8 score. However, EPSS is only 0.02% (7th percentile) and the issue is not on CISA KEV, so there is no public exploit identified at time of analysis. The Tags include 'Information Disclosure' which is consistent with op-cache leakage, but the description emphasizes 'instruction corruption,' suggesting an integrity/availability bug rather than a pure infoleak - these signals are partially conflicting and the exact exploitation primitive should be confirmed by reading the kernel commits. Realistic priority: high for multi-tenant cloud, KVM hosts, and shared-CPU environments running AMD Zen2 (EPYC Rome, Ryzen 3000), low for single-tenant or non-Zen2 systems.
Exploit ScenarioDerived

A low-privileged local user or unprivileged guest VM on an AMD Zen2 host runs a crafted workload that intentionally pollutes or shares state in the op cache with a sibling SMT thread executing in a different security domain (kernel, hypervisor, or another tenant). Because the op cache is not properly isolated, the attacker can either induce instruction corruption in the victim context (leading to crashes or controllable misexecution) or observe leakage of decoded operations corresponding to sensitive code paths. No public exploit identified at time of analysis, but the CVSS S:C/PR:L/AC:L vector indicates the primitive is straightforward to trigger once a working PoC exists.
Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 30, 2026

Local privilege escalation and information disclosure in the Linux kernel on AMD Zen2 CPUs allows low-privileged users to trigger instruction corruption via improper isolation of shared resources in the op cache. Affecting kernels prior to 5.10.256, 5.15.207, 6.1.173, 6.6.139, 6.12.88, 6.18.30, and 7.0.7, the flaw carries a CVSS 8.8 due to scope change (S:C) impacting confidentiality, integrity, and availability beyond the original security boundary. EPSS is very low (0.02%, 7th percentile) and no public exploit identified at time of analysis, but the architectural nature of the bug (CPU op cache sharing) makes it relevant for multi-tenant and virtualization workloads.

RemediationAI

Vendor-released patch: upgrade to Linux kernel 5.10.256, 5.15.207, 6.1.173, 6.6.139, 6.12.88, 6.18.30, 7.0.7, or 7.1-rc4 (or later) - pick the version matching your stable branch. Distribution-shipped kernels (RHEL, Ubuntu, SUSE, Debian, Amazon Linux) should be updated as soon as the corresponding backport is published; track the stable commits listed at git.kernel.org/stable/c/ (e.g., f5bc3aef7df4, 1e23b30a80b1) to confirm your distro has picked up the fix. As an interim compensating control on AMD Zen2 hosts running untrusted workloads, disable SMT in BIOS or via 'nosmt' on the kernel command line to eliminate sibling-thread sharing of the op cache - note this typically costs 15-30% throughput on parallel workloads. For multi-tenant KVM environments, consider pinning guests to dedicated physical cores (CPU pinning with isolation) until the patched kernel is deployed; this preserves performance but increases scheduling complexity. Migrating sensitive workloads off Zen2 hardware to Zen3/Zen4 (which are not listed as affected) is a longer-term option.

Affected VersionsENISA

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <f5bc3aef7df46eaaf423d7413ab8833f704ae576
Linux 0 <6.18.30
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <28f5ed477eef166d678d6966762cbc1de9b4f436
Linux patch: 6.12.88
Linux patch: 5.10.256
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <9109489cc8c34e50d15575a3d1ff82af586bc1aa
Linux 0 <6.1.173
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <1cd85a19748b2407830376a5cbae5c0f126016e5
Linux 0 <5.10.256
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <251497955f2314cd39d43191e81c6151dead4c7b
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <c21b90f77687075115d989e53a8ec5e2bb427ab1
Linux patch: 7.0.7
Linux 0 <6.6.139
Linux 0 <6.12.88
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <ff6fc65b3bf73acc5ee71919154d830ad5431362
Linux 0 <5.15.207
Linux 0 <7.0.7
Linux patch: 6.6.139
Linux patch: 5.15.207
Linux patch: 7.1-rc4
Linux patch: 6.1.173
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <1e23b30a80b14e5764657401ee2cca030525ae8e
Linux patch: 6.18.30

Affected Packages

euvd linux fix: 5.10.256, 5.15.207, 6.1.173, 6.6.139, 6.12.88, 6.18.30, 7.0.7

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in the x86/CPU/AMD subsystem of the Linux kernel, specifically in how it manages the op cache on AMD Zen2 microarchitecture processors. The op cache (also called micro-op cache) stores decoded micro-operations to accelerate instruction fetch, and on Zen2 it can be shared between sibling SMT threads or guest/host contexts. Without proper isolation, decoded operations from one execution context can leak into or corrupt the instruction stream of another, producing incorrect execution behavior. While no CWE is assigned, this aligns with CWE-203 (observable discrepancy / side channel) or CWE-1189 (improper isolation of shared resources between security domains), and is conceptually similar to prior microarchitectural side-channel issues like L1TF, MDS, and Retbleed that targeted shared CPU structures.

Know when Amd gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SUSE HIGH
Red Hat 7.0 MEDIUM

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
May 30, 2026 - 11:22 NVD
8.8 (HIGH)
Patch available
May 28, 2026 - 12:01 EUVD
CVE Published
May 28, 2026 - 10:16 nvd
UNKNOWN (no severity yet)
CVE Published
May 28, 2026 - 10:16 nvd
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache

Make sure resources are not improperly shared in the op cache and cause instruction corruption this way.

Executive ViewAI

Why It Matters

A high-severity local privilege escalation vulnerability in Linux kernels running on AMD Zen2 processors allows low-privileged users to corrupt CPU instructions and escalate privileges across security boundaries, potentially exposing sensitive data and system confidentiality. Organizations operating multi-tenant infrastructure, cloud platforms, or virtualized environments are at elevated risk, as the vulnerability exploits shared CPU cache architecture. Immediate kernel updates are required to restore proper isolation and prevent unauthorized lateral movement within shared systems.

Business Impact: High
Compensating Controls

Apply vendor patch. No interim mitigations available; kernel update required to address the underlying CPU cache isolation defect.

Threat Intelligence Overview

Threat Score
5.3/10
Composite threat intelligence
EPSS Score
0.0%
Top 93% exploitable
Threat Intel
1
1 sources
Exploit
POC
Public exploit code exists
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
Poc
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

74
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: +20
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Amd

View all
CVE-2021-22986 CRITICAL POC
9.8 Mar 31

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
CVE-2020-6103 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6102 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6101 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6100 CRITICAL POC
9.9 Jul 20

An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. Rated criti
CVE-2018-6546 CRITICAL POC
9.8 Apr 13

plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming
CVE-2021-3653 HIGH POC
8.8 Sep 29

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. Rated high severity (CVSS 8.8), this vu
CVE-2020-12138 HIGH POC
8.8 Apr 27

AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of se
CVE-2019-5098 HIGH POC
8.6 Dec 05

An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. Rated high
CVE-2015-7724 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2015-7723 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2023-1048 HIGH POC
7.8 Feb 26

A vulnerability, which was classified as critical, has been found in TechPowerUp Ryzen DRAM Calculator 1.2.0.5.sys. Rate

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Threat IntelligenceMISP

CISA Advisories
ICSA-26-209-04
Sources: Microsoft MSRC, CISA (public domain)

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-46174 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/366642 REF https://cert-portal.siemens.com/productcert/html/ssa-019113.html REF https://cert-portal.siemens.com/productcert/html/ssa-082556.html REF https://cert-portal.siemens.com/productcert/html/ssa-457936.html REF https://git.kernel.org/stable/c/1cd85a19748b2407830376a5cbae5c0f126016e5 REF https://git.kernel.org/stable/c/1e23b30a80b14e5764657401ee2cca030525ae8e REF https://git.kernel.org/stable/c/251497955f2314cd39d43191e81c6151dead4c7b REF https://git.kernel.org/stable/c/28f5ed477eef166d678d6966762cbc1de9b4f436 REF https://git.kernel.org/stable/c/9109489cc8c34e50d15575a3d1ff82af586bc1aa REF https://git.kernel.org/stable/c/c21b90f77687075115d989e53a8ec5e2bb427ab1 REF https://git.kernel.org/stable/c/f5bc3aef7df46eaaf423d7413ab8833f704ae576 REF https://git.kernel.org/stable/c/ff6fc65b3bf73acc5ee71919154d830ad5431362

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy