CVE-2026-46014

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Add missing save/restore handling of LBR MSRs

MSRIA32DEBUGCTLMSR and LBR MSRs are currently not enumerated by KVMGETMSRINDEXLIST, and LBR MSRs cannot be set with KVMSETMSRS. So save/restore is completely broken.

Fix it by adding the MSRs to msrstosavebase, and allowing writes to LBR MSRs from userspace only (as they are read-only MSRs) if LBR virtualization is enabled. Additionally, to correctly restore L1's LBRs while L2 is running, make sure the LBRs are copied from the captured VMCB01 save area in svmcopyvmrunstate().

Note, for VMX, this also fixes a flaw where MSRIA32DEBUGCTLMSR isn't reported as an MSR to save/restore.

Note #2, over-reporting MSRIA32LASTxxx on Intel is ok, as KVM already handles unsupported reads and writes thanks to commit b5e2fec0ebc3 ("KVM: Ignore DEBUGCTL MSRs with no effect") (kvmdomsr_access() will morph the unsupported userspace write into a nop).

[sean: guard with lbrv checks, massage changelog]