Executive brief
A memory management bug in the Linux kernel's KVM virtualization layer can cause a virtual machine to crash or potentially allow a guest operating system to escape its isolation. The vulnerability occurs when KVM improperly tracks shadow memory pages used for address translation, leading to access of freed memory. This affects systems running virtual machines, particularly those using nested virtualization or complex memory configurations.
Technical details
The vulnerability is a use-after-free in KVM's x86 shadow MMU (Memory Management Unit) implementation, specifically in the __kvm_mmu_get_shadow_page() function. The root cause is that invalid shadow pages are added to the active MMU page list due to missing validity checks when deriving a child shadow page's role from its parent. When __kvm_mmu_prepare_zap_page() processes an invalid page, it incorrectly uses list_add() instead of list_move(), creating a dangling reference. An attacker with the ability to trigger specific guest page fault sequences can cause this condition, leading to a use-after-free vulnerability (CVSS 9.3). The fix explicitly clears role.invalid when creating child shadow pages and adds validation warnings if a parent page is invalid.
Affected products
- Linux Linux kernel 7.2.0-rc2 and likely earlier versions with KVM support
Timeline
- 2026-09-03: disclosed
- 2026-09-03: patched: Fix applied to resolve the vulnerability by clearing role.invalid and adding validation checks