PT-2026-37406 · Linux · Linux Kernel

Published 2026-05-06 · Updated 2026-05-19 · CVE-2026-43096

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the mshv handle gpa intercept() function where the system fails to validate intercept access types against region permissions before attempting to remap pages for movable memory regions. When a guest attempts to write to a read-only region, the remap succeeds but the region remains read-only, leading to an infinite fault loop that causes the vCPU to spin indefinitely. This creates a Denial of Service (DoS) vector allowing malicious guests to consume host resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2026-43096

Affected Products

Linux Kernel

References · 11

• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43096 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43096 · Vendor Advisory
• https://git.kernel.org/stable/c/02226839079ccc558820a3b25c4c46812927b4ba · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43096 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-43096 · Security Note
• https://ubuntu.com/security/CVE-2026-43096 · Vendor Advisory
• https://git.kernel.org/stable/c/16cbec24897624051b324aa3a85859c38ca65fde · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43096 · Vendor Advisory
• https://t.me/cveNotify/164102 · Telegram Post
• https://git.kernel.org/linus/16cbec24897624051b324aa3a85859c38ca65fde · Note
• https://twitter.com/VulmonFeeds/status/2052028346414842243 · Twitter Post