PT-2026-55697 · Linux+1 · Linux Kernel+1
CVSS v3.1
8.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A use-after-free issue exists in the x86 shadow MMU of the Kernel-based Virtual Machine (KVM) subsystem. The flaw occurs in the
rmap remove() function when a Page Directory Entry (PDE) mapping is changed from outside the guest and a memslot is subsequently deleted. Specifically, if a modified PDE points to a non-leaf page, the kvm mmu get child sp() function fails to compare the role of the page, leading to the reuse of a page with an incorrect role (e.g., a 2MB page with direct=1 instead of a 4KB page with direct=0). When the child is zapped, kvm mmu page get gfn() computes an incorrect Guest Frame Number (GFN), causing the system to fail to remove the recorded rmap entry. Consequently, when the memslot is dropped, the shadow page is freed while the rmap entry survives. Subsequent operations, such as dirty logging or MMU notifier invalidation, dereference a pointer to the freed page. This can be exploited by a guest VM with root privileges to cause a host kernel panic (denial of service) or achieve guest-to-host escape to execute arbitrary code with root privileges on the host system. The issue affects both Intel and AMD x86 architectures.Recommendations
Update the Linux kernel to versions 7.1.3, 6.18.38, 6.12.95, 6.6.144, 6.1.177, 5.15.211, or 5.10.260.
As a mitigation measure, disable nested virtualization by setting
kvm intel.nested=0 and kvm amd.nested=0 in the kernel arguments.Exploit
Fix
LPE
DoS
RCE
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux Kernel
Rocky Linux