Junglewise Threat Intelligence

CVE-2026-43214: Linux Kernel KVM missing SRCU protection in __get_sregs2

CVE-2026-43214 · Severity: high · CVSS 7.8 · Published 2026-05-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's virtualization component (KVM) that could allow a local user to cause system instability or potentially access sensitive information. The issue occurs when the system reads specific processor registers (PDPTRs) without proper synchronization, which can lead to improper memory access. This could result in a system crash or unauthorized data access on servers running virtual machines.

Technical details

A vulnerability exists in the Linux kernel KVM x86 implementation within the __get_sregs2() function. When reading Page-Directory-Pointer Table Registers (PDPTRs) during PAE paging, the code fails to acquire the necessary Sleepable Read-Copy Update (SRCU) locks. This leads to a race condition where kvm_vcpu_gfn_to_memslot() dereferences memslots without holding kvm->srcu or kvm->slots_lock, triggering a lockdep warning and potentially leading to use-after-free or other memory integrity issues. An attacker with local access to the KVM ioctl interface could exploit this to cause a denial of service or escalate privileges. The issue has been resolved by adding SRCU read-side protection around the PDPTR reading loop in arch/x86/kvm/x86.c.

Affected products

  • Linux Linux Kernel 5.14 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6

Timeline

  • 2026-01-24: patched: Initial patch authored by Vasiliy Kovalev
  • 2026-05-06: advisory: CVE-2026-43214 published by kernel.org

References

Related threats