Database/Kernel, userspace & hypervisor
Linux KVM arm64: __kvm_at_swap_desc computes the wrong address when swapping page-table descriptors
Impact
When KVM on arm64 swaps stage-1/stage-2 page-table descriptors, __kvm_at_swap_desc() adds the offset to a u64 pointer and not to a byte address. With a non-zero offset it therefore touches hva + offset*8, not hva + offset. The kernel fix describes only the arithmetic error. Exploitability and the exact guest-side trigger are not stated in the record, but the scored vector (local, low privilege, scope changed, high C/I/A) treats it as a possible guest-to-host boundary issue. Only arm64 KVM hosts running the affected kernels (6.19, 7.0 per the record) are exposed. x86 GPU nodes are not affected.
Who can reach it
Local, low-privilege (CVSS AV:L/PR:L), presumably code running in a KVM guest on an arm64 host whose descriptor update KVM performs. The record does not state the exact preconditions.
What to do
Install a kernel that contains the stable fix commits listed below, then drain guests from each arm64 KVM host and reboot it. The record names no fixed version numbers, so check your distribution's kernel advisory. No mitigation is described.
References
Related entries
- Linux kernel (arch/x86/kvm): An emulated MMIO write that straddles a page boundary onto a second MMIO page is splitCVE-2026-31588 · Linux kernel (arch/x86/kvm)High
- Linux kernel (drivers/iommu/generic_pt): When an unmap lands in the middle of a large or contiguous page-table entryCVE-2026-31735 · Linux kernel (drivers/iommu/generic_pt)High
- OpenSSL: use-after-free in PKCS7_verify when a signed message carries an empty digestAlgorithms setCVE-2026-45447 · OpenSSL PKCS7_verify (empty digestAlgorithms SET)High
- Linux kernel (drivers/iommu/intel): A live 512-bit VT-d PASID entry is replaced with a single structure copy, so theCVE-2026-45945 · Linux kernel (drivers/iommu/intel)High
- Linux kernel (arch/x86/kvm/mmu): The shadow MMU derives GFNs for direct shadow pages arithmetically, which breaks ifCVE-2026-46113 · Linux kernel (arch/x86/kvm/mmu)High
- KVM arm64: nested_mmus array reallocated outside mmu_lock, leaving MMU-notifier walkers on freed memoryCVE-2026-46317 · Linux kernel KVM arm64 (nested virtualization nested_mmus array)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.