Linux kernel KVM x86 MMU: invalid parent role propagates to child shadow pages, use-after-free

Impact

When KVM derives a child shadow page's role from its parent, it carried over role.invalid instead of clearing it. An invalid page must never sit on the list of active MMU pages, and when one does, __kvm_mmu_prepare_zap_page() uses list_add() rather than list_move(), corrupting the list and producing a use-after-free. The KASAN report in the record shows an 8-byte write into a freed shadow page from __kvm_mmu_get_shadow_page(), reached through mmu_alloc_root() on the ordinary KVM_RUN path, with the free coming from kvm_mmu_free_roots() in the same task. That is a host-kernel heap write primitive driven from a VM, on a hypervisor node where the same kernel is shared by every tenant VM and their passed-through GPUs; the record does not establish a working guest-to-host escape, only the corruption primitive. The fix clears role.invalid and adds a WARN so a missed validity check is loud instead of silent.

Who can reach it

Local: anything that can open /dev/kvm and run a vCPU - a VMM process, or a tenant allowed to run nested/VM workloads on the node. No host privileges beyond KVM access are needed; no remote path.

What to do

Take the stable kernel update carrying commit 9f7760a2e962 (or the matching backport for your branch), then drain and reboot each hypervisor node - the change is in the KVM MMU core, so it does not apply by reloading the kvm module under running guests. Until then the exposure is bounded by who can reach /dev/kvm on the node.

References

Related entries

• Linux kernel x86/mce: CMCI discovery kicks the MCE polling timer before it is initializedCVE-2026-80727 · Linux kernel x86 MCE (CMCI discovery vs. polling timer initialization order)Unscored
• Linux kernel mm: folio split leaves memcg-charged page-cache xa_nodes off the shadow_nodes list_lruCVE-2026-80729 · Linux kernel mm/huge_memory (page-cache folio split, shadow_nodes list_lru accounting)Unscored
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical
• VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCVE-2020-3992 · VMware ESXi (OpenSLP)Critical
• Linux kernel mlx5_core kTLS RX offload: TLS RX resync list corruption: entries are moved by the resync handlerCVE-2021-47215 · Linux kernel mlx5_core kTLS RX offloadCritical