Executive brief
A vulnerability exists in the Linux kernel's Microsoft Hyper-V (mshv) driver that could allow a local user to crash the system. The issue occurs when the system fails to properly clean up memory tracking information during an error, leading to a kernel panic when that memory is later accessed. This primarily impacts the stability and availability of systems running as Hyper-V root partitions.
Technical details
A use-after-free (UAF) vulnerability exists in the mshv_map_user_memory() function within drivers/hv/mshv_root_main.c. In the error handling path, the code originally called vfree() on a memory region without first unregistering the associated MMU notifier. If userspace subsequently unmaps that memory, the still-registered notifier triggers and attempts to access the already-freed region. This flaw can be exploited by a local attacker with low privileges to cause a denial of service (kernel panic) or potentially achieve elevated code execution. The fix involves replacing the direct vfree() call with mshv_region_put() to ensure proper unregistration of the notifier.
Affected products
- Linux Linux Kernel 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-03-12: other: Vulnerability fixed in upstream source code
- 2026-04-03: advisory: CVE-2026-23432 published by kernel.org