Executive brief
A vulnerability in the Linux kernel's KVM virtualization subsystem affects the memory management unit (MMU) code used by virtual machines. An attacker with local access to a system running KVM could exploit a race condition to cause a crash or potentially execute arbitrary code, compromising the hypervisor and all guest virtual machines running on it.
Technical details
The vulnerability is a use-after-free in the KVM x86 MMU rmap (reverse mapping) walking code. The root cause is that kvm_rmap_age_gfn_range() performs a lockless walk without consuming the rmap lock value returned by kvm_rmap_lock_readonly(), instead re-reading the rmap value directly. This creates a race condition: if the rmap is initially empty (lock elided), but then populated by a concurrent writer between the lock and iterator's re-read, the walker traverses the rmap without holding the necessary lock. A writer can then free the pte_list_desc chain via kmem_cache_free() while the walk is in progress, causing a slab use-after-free. This occurs in kernels with CONFIG_KVM_MMU_LOCKLESS_AGING=y. The fix has the lockless walk consume the locked value directly rather than re-reading the rmap, preventing the race window.
Affected products
- Linux Linux kernel kernels with CONFIG_KVM_MMU_LOCKLESS_AGING enabled
Timeline
- 2026-09-16: disclosed