Executive brief
A vulnerability in the Linux kernel's Microsoft Hyper-V Virtual Trust Level (mshv_vtl) driver could allow a local user to cause a system crash. The issue occurs when the system attempts to register specific memory ranges that exceed supported internal limits, leading to a kernel warning and failure. This primarily impacts the availability of virtualized environments running on affected Linux kernels.
Technical details
The vulnerability exists in the mshv_vtl driver during the registration of VTL0 memory via the MSHV_ADD_VTL0_MEMORY ioctl. The kernel calculates 'pgmap->vmemmap_shift' based on trailing zeros of the memory range endpoints but fails to clamp this value to 'MAX_FOLIO_ORDER'. If a user provides a sufficiently aligned physical range, the resulting shift exceeds what 'memremap_pages()' accepts, triggering a kernel WARN and returning -EINVAL. An attacker with local access to the hypervisor interface could exploit this to cause a denial-of-service (DoS) or trigger kernel warnings. The fix implements clamping of the shift value and improves error code propagation.
Affected products
- Linux Linux Kernel Fixed in 404cd6b and a142ca4
Timeline
- 2026-04-06: patched: Initial patch authored by Naman Jain
- 2026-05-08: disclosed: CVE-2026-43348 published