Executive brief
A vulnerability in the Linux kernel's virtualization component (KVM) could allow a guest virtual machine to crash the host computer. This occurs when the system attempts to optimize memory usage for the guest but fails to properly verify memory boundaries. An attacker with control over a guest virtual machine could exploit this to cause a denial-of-service by triggering a kernel panic on the host.
Technical details
An out-of-bounds access vulnerability exists in the KVM x86 shadow MMU during hugepage recovery. The root cause is a missing bounds check on the guest frame number (gfn) before accessing the memslot's lpage_info array in kvm_mmu_max_mapping_level(). If a guest creates a hugepage mapping that extends below the bounds of a memslot, KVM may link a direct shadow page with an out-of-bounds gfn. When the hugepage recovery flow later queries the max mapping level for this gfn, it triggers a supervisor read access page fault (#PF) on the host. The fix introduces a call to is_gfn_in_memslot() to ensure the gfn is valid before querying the mapping level.
Affected products
- Linux Linux Kernel 7.1.0-rc1
Timeline
- 2026-04-29: other: Patch authored
- 2026-07-04: patched: Patch committed to stable tree
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/18587f9831612e24cd8f24be1ec15478feff7abc
- https://git.kernel.org/stable/c/48b91ed7e22bb82571c34f8b80b6ecdc90a6fab8
- https://git.kernel.org/stable/c/5cab1c989f938f5e1b9a0de66486f1fc2c28479b
- https://git.kernel.org/stable/c/7b52008023b7facf40fba3ebe92449bda8ea53b9
- https://git.kernel.org/stable/c/b2ae3245ea44dccaa9af676b6747476951883318
- https://git.kernel.org/stable/c/c5c29b3c268332afe67d598a034c58344540ed92
- https://git.kernel.org/stable/c/ef057cbf825e03b63f6edf5980f96abf3c53089d