Linux Kernel KVM EUVD-2026-32413

The affected subsystem is Linux KVM's nested SVM implementation (nSVM), which enables a guest hypervisor (L1) to host its own guests (L2) using AMD-V hardware extensions. During a nested #VMEXIT - the transition that returns control from an L2 guest back to L1 - the processor must restore the host's CR3 register, which holds the physical base address of the page-directory hierarchy and is critical for correct virtual-to-physical address translation. If this load fails (e.g., due to an illegal or inaccessible host-state area), the AMD APM mandates a processor shutdown. The kernel code at nested_svm_vmexit() returned an error code for this condition, but most of its callers in the nSVM path discarded the return value, so execution continued with a corrupted L1 address space. The CWE field is listed as N/A, but this maps most closely to CWE-252 (Unchecked Return Value) compounded by CWE-755 (Improper Handling of Exceptional Conditions). The 'Code Injection' tag from the intelligence source appears misapplied - the CVSS impact metrics (C:N/I:N/A:H) confirm this is an availability-only issue with no integrity or confidentiality components. Affected product: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* starting from the introduction of nested SVM support through the relevant stable branches prior to the fix commits.