Linux kernel (arch/x86/kvm/mmu): A guest that creates a hugepage mapping extending below the bounds of a memslot makes

Impact

A guest that creates a hugepage mapping extending below the bounds of a memslot makes KVM link a shadow page whose GFN is outside the slot; hugepage recovery then indexes the slot's lpage_info array out of bounds. The observed result is a host page fault on a vmalloc address - a guest-driven out-of-bounds access in host kernel memory that takes the whole node with it.

Who can reach it

Driven from inside the guest by arranging its own page tables: the guest installs a hugepage mapping whose range crosses the edge of a memslot, then the host's hugepage recovery worker walks it. Requires the shadow MMU (guest without EPT/NPT-backed TDP, nested guests, or dirty-logging-forced 4K mappings). Any tenant VM on an affected node can set this up.

What to do

Update to a kernel with the referenced stable commits. Interim: avoid running tenants on the shadow-MMU path where possible - keep TDP enabled (kvm.tdp_mmu=Y / ept=1 / npt=1) and avoid long dirty-logging windows on unpatched nodes.

References

Related entries

• Linux kernel (arch/x86/kvm/mmu): If reclaiming shadow pages invalidates the root a fault is being serviced against, KVMCVE-2026-64561 · Linux kernel (arch/x86/kvm/mmu)High
• Linux kernel (arch/x86/kvm/mmu): The TDP MMU skipped invalid roots when unmapping a GFN range, so KVM could still holdCVE-2021-47639 · Linux kernel (arch/x86/kvm/mmu)High
• Linux kernel (arch/x86/kvm/mmu): When guest memory is backed by a VM_PFNMAP mapping, KVM derived the target page frameCVE-2022-49562 · Linux kernel (arch/x86/kvm/mmu)High
• Linux kernel (arch/x86/kvm/mmu): The shadow MMU derives GFNs for direct shadow pages arithmetically, which breaks ifCVE-2026-46113 · Linux kernel (arch/x86/kvm/mmu)High
• Linux kernel (arch/x86/kvm/mmu): Shadow-page lookup reuses a page without comparing its role, so a direct (2MB) shadowCVE-2026-53359 · Linux kernel (arch/x86/kvm/mmu)High
• Linux kernel (net/xfrm): Transport-mode reinjection stashes a network-namespace pointer in the socket buffer's controlCVE-2026-63919 · Linux kernel (net/xfrm)High