Database/Kernel, userspace & hypervisor
Azure Kubernetes Service kernel-mshv: improper privilege management allows local privilege escalation
Impact
A local user with low privileges on an affected AKS node can raise their privileges. Microsoft rates the impact high for confidentiality, integrity and availability. The affected package is kernel-mshv, the Azure Linux kernel that runs on Microsoft Hypervisor, which AKS uses for hypervisor-isolated (pod sandboxing) node pools. If the escalation crosses that isolation boundary, a workload placed there to contain an untrusted tenant could get the access it was meant to be denied. The record does not say which component is at fault or whether the escalation stays inside the guest or reaches the host.
Who can reach it
Local, authenticated: a low-privilege user or workload on an AKS node running the affected kernel-mshv build. No user interaction is needed.
What to do
Take the AKS node image or kernel-mshv update that the Microsoft advisory names. The record gives no fixed version. Kernel updates on AKS usually ship through a node image upgrade, which cordons, drains and reimages each node, so plan capacity for GPU node pools where pods are slow to reschedule.
References
Related entries
- libvirt: integer overflow in NodeGetFreePages gives a local user heap corruption in the root daemonCVE-2026-18917 · libvirt (NodeGetFreePages RPC handler)High
- Linux KVM - irqfd routing type clobbered on deassign: Deassigning a KVM_IRQFD clobbers the irqfd's copy of theCVE-2026-23198 · Linux KVM - irqfd routing type clobbered on deassignHigh
- Linux kernel (net/xfrm): Closing an ESP-in-TCP socket cancels its transmit work item, but the write-space callback canCVE-2026-23239 · Linux kernel (net/xfrm)High
- Linux kernel perf: use-after-free on the perf ring buffer when mmap setup fails during a concurrent attachCVE-2026-23248 · Linux kernel perf/core (perf_mmap ring-buffer refcount)High
- Linux kernel perf: software events run the overflow path with IRQs enabled, racing teardown of the event's BPF programCVE-2026-23271 · Linux kernel perf (__perf_event_overflow vs perf_remove_from_context)High
- Linux kernel io_uring: task-work flag write can land on freed rings during a concurrent ring resizeCVE-2026-23275 · Linux kernel io_uring (ring resize vs task-work flag update)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.