Executive brief
A vulnerability in the Linux Kernel's virtualization component (KVM) could allow a user running a virtual machine to crash the host computer's operating system. By sending a specifically crafted memory command that spans across two memory pages, the guest system triggers a critical error (kernel panic) in the host. This results in a complete denial of service for the host and all other virtual machines running on it.
Technical details
A vulnerability in the Linux kernel's KVM subsystem exists in the ioeventfd datamatch logic. When a guest performs a memory store that splits a page boundary where the second page contains a datamatch-enabled ioeventfd at offset 0, KVM's x86 emulator handles the fragments independently. If the remaining data fragment is not aligned to the ioeventfd length, a BUG_ON() macro is triggered in `virt/kvm/eventfd.c`. This occurs because the emulator uses the destination value pointer with an offset that may not satisfy the alignment check. An attacker with privileges to execute code in a guest VM can trigger this condition to cause a host kernel panic (DoS). The fix replaces the alignment check and direct pointer dereference with `get_unaligned()` to safely handle unaligned accesses.
Affected products
- Linux Linux Kernel All versions since 2009 (fixed in 7.1-rc2 and stable backports)
Timeline
- 2026-06-12: other: Patch authored
- 2026-07-04: patched: Patch committed to stable trees
- 2026-07-19: disclosed: CVE published