Database/Kernel, userspace & hypervisor
Linux KVM - dirty-page tracking without a vCPU on a dying VM: KVM warned (and on panic_on_warn hosts, panicked)
Impact
KVM warned (and on panic_on_warn hosts, panicked) when a page was marked dirty without an associated vCPU while a VM was being torn down. A guest that can arrange the teardown timing turns a warning into a host crash on any fleet running panic_on_warn - which plenty of hardened kernels do.
Who can reach it
From inside a guest, by timing VM teardown. Tenant-reachable.
What to do
Fixed in the Linux kernel. Take the distro kernel update (RHEL/Rocky, Ubuntu, SLES) and reboot the host - no firmware, VBIOS or AGESA step. On a GPU fleet this is a cordon, drain and rolling reboot; plan it as normal kernel maintenance. If you run panic_on_warn on GPU hosts for crash-dump fidelity, note that it converts warning-class kernel bugs like this into fleet availability incidents - worth reviewing that setting alongside the patch.
References
Related entries
- Linux kernel (drivers/iommu/intel): VT-d accepted a PASID attachment to a nested domain whose parent has dirty trackingCVE-2026-53372 · Linux kernel (drivers/iommu/intel)Medium
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): Missing or insufficient validation of user-suppliedCVE-2026-53376 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)Medium
- Linux kernel NVMe: bio leaked when integrity mapping fails on a user-mapped requestCVE-2026-64072 · Linux kernel NVMe driver (user request mapping, integrity path)Medium
- Linux kernel BPF inode storage: map creation without BPF LSM initialized panics the host on RCU callbackCVE-2026-64192 · Linux kernel BPF inode storage maps (BPF_MAP_TYPE_INODE_STORAGE)Medium
- Linux kernel mm: mincore/MADV_PAGEOUT ownership checks use the wrong idmap on idmapped mountsCVE-2026-64294 · Linux kernel mm (mincore / madvise MADV_PAGEOUT file ownership check)Medium
- Linux kernel x86/mm: vmemmap pages freed as page tables leak memory on memory hot-removeCVE-2026-64302 · Linux kernel x86/mm (vmemmap page freeing on memory hot-remove)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.