Linux KVM CVE-2026-89928

Exploitation requires the host kernel to be built with CONFIG_KVM_MMU_LOCKLESS_AGING=y, so that kvm_rmap_age_gfn_range() runs the rmap aging walk without holding mmu_lock. The attacker must win a race: a writer holding mmu_lock for write must populate a KVM_RMAP_MANY rmap during the lock-elision window (rmap observed empty) and then free the pte_list_desc chain (e.g. via kvm_zap_all_rmap_sptes on the recycle path or any rmap zap) while the lockless aging walk is in progress. Limiting factors: this is local (AV:L per CVSS) and requires the privilege to operate a KVM guest / drive host MMU state (PR:L, no PR:N); no user interaction; it is timing-dependent (a scheduling-delay-sized race window, not deterministic); and the aging path is invoked by host memory reclaim rather than at attacker will, so triggering is opportunistic. Affected versions are Linux 6.15 through the fixes in 6.18.51, 7.2.5, and 7.3-rc1.

This is a slab use-after-free arising from a race condition (CWE-416/CWE-362) in KVM x86/mmu's lockless rmap aging path, not a remote-code-execution issue. The vendor CVSS of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) overstates real-world risk on two counts. First, AC:L is inconsistent with the description, which centers on a narrow timing window: a writer must populate the rmap between the lock's read and the iterator's re-read while the aging path (kvm_rmap_age_gfn_range) runs lockless - this is a race, so AC:H is more honest. Second, the description is DoS-dominant (walking a freed pte_list_desc chain → slab corruption/crash); C:H/I:H are speculative absent a demonstrated read/write-primitive exploit, so C:N/I:L/A:H better reflects the described impact. No EPSS score, no CISA KEV listing, and no public exploit are present - consistent with a freshly-published upstream Linux fix. Exploitation status: no public exploit identified at time of analysis. The aging path is triggered by host memory reclaim (an MMU notifier), not directly by an attacker clock, further raising the difficulty of deterministic exploitation. CONFLICT TO VERIFY: the input 'RCE' tag contradicts the description, which describes a use-after-free leading to host instability, not remote code execution - treat the RCE label as incorrect. CVSS AV:L is consistent with the local (guest/host) nature of the flaw.

A local attacker who can run a KVM guest (or otherwise drive host MMU rmap population/zapping) races SPTE writes against the host's lockless page-aging walk while CONFIG_KVM_MMU_LOCKLESS_AGING=y. If a writer installs a KVM_RMAP_MANY rmap in the elision window and then frees the pte_list_desc chain via a zap/recycle path, the unsynchronized aging walker dereferences freed slab memory, corrupting host kernel state and crashing the host. No public proof-of-concept is known; the timing-dependent nature makes reliable triggering difficult.