CVE-2026-46295

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified) openSUSE Tumbleweed versions prior to kernel-devel-7.0.12-1.1

Description A race condition exists in the KVM x86 component between vmx sync pir to irr() on a target vCPU and vmx deliver posted interrupt() on a sender vCPU. The sender performs two atomic operations—setting the PIR bit via pi test and set pir(vector) and setting PID.ON via pi test and set on()—that are not executed as a single transaction. This can lead to a scenario where pi test on() returns true but pi harvest pir() finds the PIR empty, causing the function to return -1 without scanning the IRR (Interrupt Request Register). While interrupts are not lost, this inconsistency results in a spurious warning in vmx check nested events() and wasted L2 VM-Enter/VM-Exit cycles.

Recommendations For openSUSE Tumbleweed, update to kernel-devel-7.0.12-1.1 or a newer version. At the moment, there is no information about a newer version that contains a fix for this vulnerability for the Linux kernel.