Executive brief
The Linux kernel's KVM hypervisor for LoongArch processors has a flaw in how it manages virtual memory settings during live migration. When dirty page logging is toggled, a flag tracking whether large pages can be used is incorrectly zeroed. This allows a guest virtual machine to map its memory using incorrect address translations, causing it to read and write the wrong host memory pages—potentially exposing or corrupting data belonging to other guests or the host system.
Technical details
The vulnerability is a logic error in the LoongArch KVM memory region preparation code. The function `kvm_arch_prepare_memory_region()` computes architecture-specific flags (KVM_MEM_HUGEPAGE_CAPABLE / KVM_MEM_HUGEPAGE_INCAPABLE) only during memory slot creation or move operations, but returns early for all other changes (including KVM_MR_FLAGS_ONLY updates used to toggle dirty page logging). Since the generic KVM code allocates a fresh zeroed memslot for each change without copying the old arch flags, these critical flags are lost after a flags-only update. With both flags clear, the hugepage eligibility check falls through to alignment checks on the host virtual address (HVA) alone, omitting the verification that guest physical address (GPA) and HVA have the same offset within a page structure. A memslot previously marked incapable due to GPA/HVA mismatch can then be mapped with PMD-sized (large) entries, causing guest page faults to resolve to incorrect host pages. The fix preserves the arch flags when only userspace-facing flags change. No user authentication is required; a guest with a configured memslot can trigger this. Patch is available in stable kernel releases.
Affected products
- Linux Linux kernel LoongArch KVM (fixed after 2026-09-04)
Timeline
- 2026-09-16: disclosed
- 2026-09-04: patched