# CVE-2026-53359: Linux Kernel KVM shadow paging use-after-free in x86 MMU

Source: https://junglewise.ai/threats/cve-2026-53359-linux-kernel-kvm-shadow-paging-use-after-free-in-x86-mmu  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-04. Updated: 2026-07-04  
License: CC BY 4.0 with a link back

CVE-2026-53359 · Severity: high · CVSS 7.8 · Published 2026-07-04

A vulnerability has been identified in the Linux kernel's virtualization component (KVM) that could allow a local attacker to crash the system or potentially execute unauthorized code. The issue occurs when the system incorrectly manages memory mappings for virtual machines, leading to a 'use-after-free' condition where the kernel attempts to access memory that has already been released. This could impact the stability and security of servers hosting virtualized environments.

Technologies: [Google Cloud Platform](https://junglewise.ai/threats/technologies/google-cloud-platform), [Linux Kernel](https://junglewise.ai/threats/technologies/kernel). Vendors: [Google](https://junglewise.ai/threats/vendors/google), [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-2026-53359 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53359 being exploited in the wild.

**How severe is CVE-2026-53359?** High severity, with a CVSS score of 7.8, published 4 July 2026.

**Which products and versions are affected?** Linux Kernel 2032a93d66fa to 1ae7d5a6db6c190ce183e3098ca0e0846e14d462.

**Is there a fix for CVE-2026-53359?** A patch was published on 2026-06-26: Initial fix authored by Paolo Bonzini Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53359 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-53359?** Check whether you run Google Cloud Platform or Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability exists in the Linux kernel KVM x86 MMU subsystem. The root cause is a failure in `kvm_mmu_get_child_sp()` to compare the page role when reusing a shadow page. Specifically, when a Page Directory Entry (PDE) is modified to point to a non-leaf page, the system may reuse a `kvm_mmu_page` with a mismatched 'direct' role. This leads to incorrect GFN calculations during page zapping, causing `rmap_remove()` to fail to delete entries. When the associated memslot is later dropped, the shadow page is freed while the rmap entry persists, resulting in a use-after-free during subsequent GFN walks (e.g., dirty logging or MMU notifier invalidation). The vulnerability is fixed by ensuring the role is validated during child shadow page retrieval.

## Affected products

- Linux Linux Kernel 2032a93d66fa to 1ae7d5a6db6c190ce183e3098ca0e0846e14d462

## Timeline

- 2026-06-26: patched: Initial fix authored by Paolo Bonzini
- 2026-07-04: advisory: CVE-2026-53359 published

## References

- [https://git.kernel.org/stable/c/1ae7d5a6db6c190ce183e3098ca0e0846e14d462](https://git.kernel.org/stable/c/1ae7d5a6db6c190ce183e3098ca0e0846e14d462)
- [https://git.kernel.org/stable/c/2ad3afa40ac6aa340dada122f9abfa46c0a6eb35](https://git.kernel.org/stable/c/2ad3afa40ac6aa340dada122f9abfa46c0a6eb35)
- [https://git.kernel.org/stable/c/5e470998a23e4c3d89ed24e8172cb22747e61efa](https://git.kernel.org/stable/c/5e470998a23e4c3d89ed24e8172cb22747e61efa)
- [https://git.kernel.org/stable/c/81ccda30b4e83d8f5cc4fd50503c44e3a33abfeb](https://git.kernel.org/stable/c/81ccda30b4e83d8f5cc4fd50503c44e3a33abfeb)
- [https://git.kernel.org/stable/c/9291654d69e08542de37755cebe4d5b02c3170d1](https://git.kernel.org/stable/c/9291654d69e08542de37755cebe4d5b02c3170d1)
- [https://git.kernel.org/stable/c/b1337aae5e194324e4810d561764e7793f8b3864](https://git.kernel.org/stable/c/b1337aae5e194324e4810d561764e7793f8b3864)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [AMD EPYC 5th generation processor data cache information leak](https://junglewise.ai/threats/cve-2024-36350-gcp-2026-081)
- [Istio authentication bypass or access control vulnerability](https://junglewise.ai/threats/cve-2026-31836-gcp-2026-080)