Skip to main content

Linux Kernel KVM CVE-2026-72283

| EUVDEUVD-2026-59182 HIGH
2026-08-15 Linux GHSA-ww73-cj9w-h762
Authentication Bypass Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

AC:H reflects the race condition between IRTE update failure and independent vector disable, plus mandatory VFIO PCI passthrough prerequisite; all other metrics align with vendor vector.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Aug 17, 2026 - 08:07 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.8 (HIGH)
CVE Published
Aug 15, 2026 - 05:55 cve.org
HIGH 8.8
CVE Published
Aug 15, 2026 - 05:55 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails

Nullify irqfd->producer if updating the IRTE for bypass fails, as leaving a dangling pointer will result in a use-after-free if the irqfd is reachable through KVM's routing, but the producer is freed separately. E.g. for VFIO PCI, the producer is embedded in struct "vfio_pci_irq_ctx" and freed when the vector is disabled, which can happen independent of routing updates.

[sean: drop PPC change, massage changelog]

AnalysisAI

Use-after-free in the Linux kernel's KVM x86 irqfd subsystem exposes hypervisor hosts to potential privilege escalation and VM escape when VFIO PCI device passthrough is in use. The flaw arises because a failed IRTE bypass update leaves irqfd->producer as a dangling pointer; if the VFIO PCI vector is subsequently disabled-an event independent of KVM routing-the now-freed vfio_pci_irq_ctx struct can be dereferenced through KVM's routing table, corrupting kernel memory. No public exploit has been identified at time of analysis and EPSS is low (0.22%, 13th percentile), but the S:C scope change in the CVSS vector reflects the potential for a low-privilege local attacker to escape VM boundaries into the host kernel.

Technical ContextAI

KVM (Kernel-based Virtual Machine) is Linux's built-in Type-1 hypervisor; irqfds are kernel file descriptors that allow userspace VMMs to inject interrupts into guest VMs. Interrupt Remapping Table Entries (IRTEs) are used by VT-d/IOMMU hardware to remap device interrupts for virtualization. VFIO PCI enables direct device passthrough from host to guest; per the description, the producer object is embedded in struct vfio_pci_irq_ctx and is freed when the associated MSI/MSI-X vector is disabled-an event that can occur entirely outside KVM's routing update path. The root cause is a classic CWE-416 (Use After Free): irqfd->producer is never nullified after an IRTE-for-bypass update fails, so any subsequent dereference through KVM's IRQ routing reaches freed memory. The CPE strings (cpe:2.3:a:linux:linux:*) confirm this affects the Linux kernel codebase broadly; the EUVD data pins the vulnerable range to commits beginning at 77e1b8332d1d7aa786f7515e9bd4055def6a1e06 across multiple stable branches.

RemediationAI

Apply the upstream kernel fix by upgrading to Linux 6.18.40 or Linux 7.1.5 (stable releases per EUVD patch data), or cherry-pick the three stable-branch commits: d5560b6569cd05ba72c6b33427fbabc6ec46b8cf, d1379888cc4230bac647ec24ab83306afbd03e88, and ed446e8aa894883c08892cfee69782fdf8f6c3ca (available at https://git.kernel.org/stable/c/). The fix nullifies irqfd->producer on IRTE bypass update failure, eliminating the dangling pointer. Upstream fix availability is confirmed via PR/commit references; released patched version confirmation should be validated against your distribution vendor's errata. As a compensating control prior to patching, disabling VFIO PCI device passthrough eliminates the specific code path-this prevents the vfio_pci_irq_ctx producer from being embedded and freed independently of KVM routing, though it also removes PCI passthrough functionality entirely. Restricting local access to the hypervisor host to trusted administrators reduces the attack surface but does not eliminate the vulnerability if low-privilege access is ever granted.

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-72283 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy