Linux kernel KVM guest_memfd: signed offset+size arithmetic defeats the binding overflow check

Impact

When binding a memslot to a guest_memfd file, KVM took the offset and size as signed loff_t values. The size is bounded by KVM's memslot limits, but the offset is unchecked until the final "offset + size > i_size" test, so a near-maximum positive offset makes the sum wrap negative and always compare smaller than the file size. KVM then accepts an absurd out-of-range binding. guest_memfd is the backing store for confidential guests (SEV-SNP/TDX), so on a GPU host that runs tenant VMs this is a memory-safety hole in the path that is supposed to isolate guest private memory from the host. The record does not describe a working exploit, only the broken bound check; the actor is whoever drives the KVM ioctls, i.e. the VMM, not an unprivileged guest.

Who can reach it

Local user or service able to issue KVM ioctls - in practice the VMM process (QEMU, Firecracker, a cloud agent) or anyone with /dev/kvm. Not reachable from the network, and not reachable from inside a guest.

What to do

Update to a stable kernel carrying the fix (commits 3f9c0fdefa04, e4683654881f, eba85fee7fc6, f3a98d5881b9) or the distribution equivalent, then reboot the hypervisor hosts. Live-migrate or drain tenant VMs first; there is no mitigation short of the new kernel.

References

Related entries

• Linux kernel (drivers/pci): An SR-IOV device that stops answering config reads makes the VF Resizable BAR restore pathCVE-2026-64460 · Linux kernel (drivers/pci)High
• Windows Server Services for NFS: use-after-free in the ONCRPC XDR driver gives local code executionCVE-2026-70585 · Windows Server Services for NFS (ONCRPC XDR kernel driver)High
• Linux kernel BPF verifier: JMP32 comparisons against zero mispredicted, allowing unsafe pointer arithmeticCVE-2026-98041 · Linux kernel BPF verifier (is_branch_taken, JMP32 pointer-vs-zero prediction)High
• Linux kernel BPF: per-CPU map updates accept invalid CPU IDs on sparse CPU masks, corrupting kernel memoryCVE-2026-98150 · Linux kernel BPF (BPF_F_CPU target-CPU validation in bpf_map_check_op_flags)High
• Linux kernel nvme-rdma: double cleanup and DMA unmap after request completion on the -EIO pathCVE-2026-98154 · Linux kernel nvme-rdma (queue_rq -EIO cleanup path)High
• Linux kernel keyctl: use-after-free reading a key type name during module unloadCVE-2026-99224 · Linux kernel keyctl (KEYCTL_DESCRIBE key type name use-after-free)High