PT-2026-61122 · Linux · Linux Kernel

CVE-2026-63806 · Published 2026-07-19 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the KVM x86 emulator where a guest can trigger a BUG ON() in the ioeventfd datamatch process. This occurs when a guest emits a store that splits a page starting at page offset N, and the second page contains a datamatch-enabled ioeventfd at offset 0. If N is not aligned to the length of the event, the system attempts to access memory using an unaligned pointer via dst.valptr[N], triggering the BUG ON() failure. This is caused by the emulator tracking the destination operand in x86 emulate ctxt.dst, which is 32-byte aligned, while the offset N may not be aligned to the required length.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-63806

Affected Products

Linux Kernel

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-63806 · Security Note
• https://git.kernel.org/stable/c/f1edbed787ba67988ed34e0132ca128b052b6ce8 · Note
• https://git.kernel.org/stable/c/bf89e3738480d33cd515b4a18900e8443d40cd2e · Note
• https://twitter.com/windowsforum/status/2079103550844465645 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2078902273892123067 · Twitter Post
• https://git.kernel.org/stable/c/5c87b47374682f69686068ad0a7779365a527b1c · Note
• https://git.kernel.org/stable/c/5da9b1a87ec7cc3489c27016313524769f12d9e0 · Note