Executive brief
A vulnerability in the Linux Kernel's virtualization component (KVM) could allow a local attacker to cause system instability or potentially access restricted memory. The issue occurs when the system tracks changes to virtual machine memory; a malicious user can provide specially crafted values that bypass safety checks. This could lead to a crash or unauthorized modifications to the host system's memory management structures.
Technical details
An integer overflow vulnerability exists in kvm_reset_dirty_gfn() within the Linux kernel's KVM implementation. The function performs an unchecked addition of a 64-bit offset and a mask value, which can be manipulated by a Virtual Machine Monitor (VMM) via a shared memory interface (MAP_SHARED) to bypass bounds checks through a u64 wrap-around. When exploited, this leads to an out-of-bounds load in gfn_to_rmap() and a subsequent conditional memory corruption (clearing of PT_WRITABLE_MASK) in the host kernel. The vulnerability is reachable by any local process with access to /dev/kvm. Patches have been released across multiple stable kernel branches to enforce strict range checking on the offset before addition.
Affected products
- Linux Linux Kernel fb04a1eddb1a to 74f1a22f
Timeline
- 2026-05-12: disclosed: Vulnerability reported by Aaron Sacks
- 2026-05-23: patched: Fix committed to stable kernel trees
- 2026-06-24: advisory: CVE-2026-52969 published
References
- https://git.kernel.org/stable/c/01b71b930f15728aa8599478a7ce90c19dcd9fc2
- https://git.kernel.org/stable/c/0d419c23bb11b5c9664de777c47c1f04a235882d
- https://git.kernel.org/stable/c/0eb281eb95b2d4eea4db1da5fe91023aecc97095
- https://git.kernel.org/stable/c/577a8d3bae0531f0e5ccfac919cd8192f920a804
- https://git.kernel.org/stable/c/74f1a22f7a80f03d28ad8551a2d25d563433addf
- https://git.kernel.org/stable/c/b315b033a877b1ee6d827810b5d7bb4392ffcf8d
- https://git.kernel.org/stable/c/ecf9b3ea7847fe14f34b8c41f00de1eb95c747da