Executive brief
A vulnerability in the Linux kernel's Microsoft Hyper-V (mshv) driver could allow a malicious guest virtual machine to cause a denial-of-service on the host system. By repeatedly attempting to write to or execute memory it does not have permission to access, a guest can trap the host's processor in an infinite loop. This results in high resource consumption and can make the host system unresponsive.
Technical details
A vulnerability exists in the mshv_handle_gpa_intercept() function within the Linux kernel's Microsoft Hyper-V (mshv) driver. The function incorrectly attempts to remap pages for all faults on movable memory regions without first validating if the access type (read, write, or execute) is permitted by the region's permissions. If a guest attempts a write or execute operation on a restricted region, the remap succeeds but the permission violation remains, causing an immediate re-fault and trapping the vCPU in an infinite loop. This can be exploited by a local guest user to consume host CPU resources (DoS). The issue has been resolved by adding explicit validation of intercept access types against region flags (HV_MAP_GPA_WRITABLE/EXECUTABLE) before remapping.
Affected products
- Linux Linux Kernel 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-03-24: other: Patch authored
- 2026-05-06: disclosed: CVE published
- 2026-05-19: advisory: NVD analysis completed