Skip to main content

Linux Kernel KVM CVE-2026-64561

| EUVDEUVD-2026-52602 HIGH
2026-08-04 Linux GHSA-hp26-g45f-hxp5
Information Disclosure Linux
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

Local guest execution (AV:L, PR:L) triggers host shadow MMU corruption with full scope change to hypervisor (S:C), warranting C:H/I:H/A:H; no user interaction required and conditions are deterministically triggerable.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
HIGH
qualitative
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 08, 2026 - 15:23 vuln.today
CVSS changed
Aug 08, 2026 - 15:22 NVD
8.8 (HIGH)
Patch available
Aug 04, 2026 - 07:01 EUVD
CVE Published
Aug 04, 2026 - 06:23 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 04, 2026 - 06:23 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Check for invalid/obsolete root *after* making MMU pages available

Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to map memory into an invalid root. On its own, populating an invalid root is "fine", but because child shadow pages inherit their parent's role, any children created during the map/fetch will be created as invalid pages, thus violating KVM's invariant that invalid pages are never on the list of active MMU pages.

Note, the underlying flaw has existed since KVM first started tracking invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root pagetables"), but the true badness only came along in 2020 (Linux 5.9) with the invariant that invalid shadow pages can't be on the list of active pages.

Note #2, inheriting role.invalid when creating child shadow pages is also far from ideal; that flaw will be addressed separately.

AnalysisAI

Shadow MMU ordering flaw in the Linux kernel KVM x86 subsystem allows a low-privileged guest process to corrupt the hypervisor's page table state by triggering invalid root population during shadow page reclamation. Kernels from 5.9 through multiple unpatched stable branches permit child shadow pages to be created under an invalidated parent root, violating a core MMU invariant and potentially enabling guest-to-host privilege escalation. No public exploit has been identified and EPSS is low (0.16%), but the confirmed scope change to the host hypervisor makes this a high-priority patch for any KVM-based multi-tenant or cloud virtualization environment.

Technical ContextAI

This vulnerability resides in the KVM x86 shadow MMU subsystem. The shadow MMU maintains a host-side mirror of guest page tables to accelerate memory access under software-assisted virtualization. When a guest triggers a page fault, KVM may need to reclaim shadow pages to satisfy the allocation - a reclamation step that can mark currently-active root pages as invalid. The bug is a check-ordering flaw: KVM was evaluating stale/invalid root status before performing the MMU page reclamation step, so a root valid at check time could be invalidated by the reclamation that followed. Because child shadow pages inherit their parent's role (including role.invalid), children created after invalidation are themselves marked invalid and incorrectly land on the active MMU page list. The invariant that invalid shadow pages must never appear on the active page list was introduced in Linux 5.9 (and is what turns this from a latent bug into an exploitable violation). The root cause traces to commit 2e53d63acba7 from 2008 ('KVM: MMU: ignore zapped root pagetables'), but the critical invariant break only materialized starting with Linux 5.9. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

The primary fix is upgrading to a patched Linux kernel: 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5 (or any subsequent release), applying the relevant stable commit from https://git.kernel.org/stable/. Distribution-specific patches should be sourced from the respective vendor (Red Hat, Ubuntu, SUSE, Debian) backporting these stable commits. As a compensating control for environments that cannot immediately patch, consider forcing hardware-assisted paging (EPT on Intel, NPT on AMD) via KVM module parameters (e.g., ensuring kvm_intel.ept=1 or kvm_amd.npt=1) to avoid the shadow MMU code path entirely - note this requires CPU support and may change guest performance characteristics. Restricting untrusted guest workloads from shared KVM hosts until patching is complete further reduces exposure. Disabling KVM entirely eliminates the attack surface but is impractical in virtualization-dependent environments.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Availability Extension 15 SP4 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected

Share

CVE-2026-64561 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy