Linux kernel KVM x86 MMU: invalid parent role propagates to child shadow pages, use-after-free

Impact

When KVM derives a child shadow page's role from its parent, it carried over role.invalid instead of clearing it. An invalid page must never sit on the list of active MMU pages, and when one does, __kvm_mmu_prepare_zap_page() uses list_add() rather than list_move(), corrupting the list and producing a use-after-free. The KASAN report in the record shows an 8-byte write into a freed shadow page from __kvm_mmu_get_shadow_page(), reached through mmu_alloc_root() on the ordinary KVM_RUN path, with the free coming from kvm_mmu_free_roots() in the same task. That is a host-kernel heap write primitive driven from a VM, on a hypervisor node where the same kernel is shared by every tenant VM and their passed-through GPUs; the record does not establish a working guest-to-host escape, only the corruption primitive. The fix clears role.invalid and adds a WARN so a missed validity check is loud instead of silent.

Who can reach it

Local: anything that can open /dev/kvm and run a vCPU - a VMM process, or a tenant allowed to run nested/VM workloads on the node. No host privileges beyond KVM access are needed; no remote path.

What to do

Take the stable kernel update carrying commit 9f7760a2e962 (or the matching backport for your branch), then drain and reboot each hypervisor node - the change is in the KVM MMU core, so it does not apply by reloading the kvm module under running guests. Until then the exposure is bounded by who can reach /dev/kvm on the node.

References

Related entries

• Linux kernel x86/mce: CMCI discovery kicks the MCE polling timer before it is initializedCVE-2026-80727 · Linux kernel x86 MCE (CMCI discovery vs. polling timer initialization order)Unscored
• Linux kernel mm: folio split leaves memcg-charged page-cache xa_nodes off the shadow_nodes list_lruCVE-2026-80729 · Linux kernel mm/huge_memory (page-cache folio split, shadow_nodes list_lru accounting)Unscored
• Linux nvmet-tcp: remote initiator can trip a kernel WARN via an oversized SGL, killing panic-on-warn hostsCVE-2026-80788 · Linux kernel nvmet-tcp (NVMe-over-TCP target SGL allocation)Unscored
• Linux kernel nvmet-tcp: unbounded kernel allocation from an unauthenticated NVMe/TCP peerCVE-2026-80789 · Linux kernel nvmet-tcp (NVMe/TCP target SGL length validation)Unscored
• Linux kernel nvmet-auth: uninitialized slab sent to a remote initiator during NVMe-oF authenticationCVE-2026-80791 · Linux kernel nvmet-auth (DH-HMAC-CHAP AUTH_RECEIVE response buffer)Unscored
• Linux kernel io_uring: folio shift overflow writes past the bvec array on 16G-hugepage kernelsCVE-2026-80810 · Linux kernel io_uring/rsrc (registered-buffer folio shift in io_vec_fill_bvec)Unscored