CVE-2026-53359

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.1.3 Linux kernel versions prior to 6.18.38 Linux kernel versions prior to 6.12.95 Linux kernel versions prior to 6.6.144 Linux kernel versions prior to 6.1.177 Linux kernel versions prior to 5.15.211 Linux kernel versions prior to 5.10.260

Description A use-after-free issue exists in the x86 shadow MMU (Memory Management Unit) of the Kernel-based Virtual Machine (KVM) subsystem. The flaw occurs in the kvm mmu get child sp() function, which reuses a page without comparing its role, leading to a mismatch when a PDE (Page Directory Entry) mapping is changed. This results in the rmap remove() function failing to remove recorded entries when a memslot is dropped. Consequently, subsequent operations such as dirty logging or MMU notifier invalidation dereference a pointer to a freed page.

An attacker with root access inside a guest VM can exploit this to cause a host kernel panic, resulting in a denial of service for all co-tenant VMs on the same node, or achieve a guest-to-host escape to execute arbitrary code with root privileges on the host. On certain distributions like RHEL where /dev/kvm is world-writable, an unprivileged local user can trigger this for local privilege escalation. The attack requires nested virtualization to be enabled on the host and affects both Intel and AMD CPUs.

Recommendations Update the Linux kernel to versions 7.1.3, 6.18.38, 6.12.95, 6.6.144, 6.1.177, 5.15.211, or 5.10.260. As a temporary mitigation, disable nested virtualization by setting kvm intel.nested=0 and kvm amd.nested=0 in the kernel arguments or via modprobe configuration.