CVE-2026-74516

The verdict

A bug in KVM's SVM (AMD) nested virtualization lets a guest VM read host APIC state, send arbitrary interrupts, and DoS the host. This happens when AVIC is inhibited while a nested guest (L2) is running: x2APIC MSR intercepts stay disabled for L1, giving it access it should never have. You need to be running KVM on AMD with nested virtualization enabled for this to bite you.

Patch urgency · Patch this week