# CVE-2026-80726: Linux kernel KVM x86 MMU use-after-free in shadow page handling

Source: https://junglewise.ai/threats/cve-2026-80726-linux-kernel-kvm-x86-mmu-use-after-free-in-shadow-page-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-80726 · Severity: critical · CVSS 9.3 · Published 2026-09-03

A memory management bug in the Linux kernel's KVM virtualization layer can cause a virtual machine to crash or potentially allow a guest operating system to escape its isolation. The vulnerability occurs when KVM improperly tracks shadow memory pages used for address translation, leading to access of freed memory. This affects systems running virtual machines, particularly those using nested virtualization or complex memory configurations.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-2026-80726 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80726 being exploited in the wild.

**How severe is CVE-2026-80726?** Critical severity, with a CVSS score of 9.3, published 3 September 2026.

**Which products and versions are affected?** Linux Kernel 7.2.0-rc2 and likely earlier versions with KVM support.

**Is there a fix for CVE-2026-80726?** A patch was published on 2026-09-03: Fix applied to resolve the vulnerability by clearing role.invalid and adding validation checks Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-80726 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-80726?** Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a use-after-free in KVM's x86 shadow MMU (Memory Management Unit) implementation, specifically in the __kvm_mmu_get_shadow_page() function. The root cause is that invalid shadow pages are added to the active MMU page list due to missing validity checks when deriving a child shadow page's role from its parent. When __kvm_mmu_prepare_zap_page() processes an invalid page, it incorrectly uses list_add() instead of list_move(), creating a dangling reference. An attacker with the ability to trigger specific guest page fault sequences can cause this condition, leading to a use-after-free vulnerability (CVSS 9.3). The fix explicitly clears role.invalid when creating child shadow pages and adds validation warnings if a parent page is invalid.

## Affected products

- Linux Linux kernel 7.2.0-rc2 and likely earlier versions with KVM support

## Timeline

- 2026-09-03: disclosed
- 2026-09-03: patched: Fix applied to resolve the vulnerability by clearing role.invalid and adding validation checks

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)