KVM x86/mmu: lockless aging walk re-reads the rmap and can follow a pte_list_desc chain being freed

Impact

__kvm_rmap_lock() deliberately skips taking the rmap lock when the rmap is empty, on the invariant that no lockless walker will then walk it. kvm_rmap_age_gfn_range() ignored that return value and entered the iterator anyway, which re-read rmap_head->val; if a writer populated the rmap in between, the aging path walked a KVM_RMAP_MANY chain it never locked, while a writer holding mmu_lock for write can free that chain via kmem_cache_free(). The result is a slab use-after-free in the host kernel, reachable on hosts built with CONFIG_KVM_MMU_LOCKLESS_AGING=y, and the empty path re-enables preemption so the window can span an arbitrary scheduling delay. On a virtualized GPU host - vGPU or passthrough VMs from multiple tenants - host-side memory corruption is a cross-tenant problem, and patching it means rebooting a hypervisor whose VMs have to be moved first. The fix makes the lockless walk consume the value returned by the lock instead of re-reading it.

Who can reach it

Local on an x86 KVM host. Triggered by memory pressure and guest memory activity racing the MMU notifier aging path; a guest can influence both sides. Requires no host credentials beyond running a VM on the host.

What to do

Take the linked stable commits or a patched distribution kernel, then drain guests and reboot each hypervisor. Hosts built without CONFIG_KVM_MMU_LOCKLESS_AGING are not exposed to the lockless aging path, which is worth checking before scheduling a fleet-wide window.

References

Related entries

• KVM nVMX: emulated INVVPID can run on the wrong physical CPU, leaving stale L2 TLB entriesCVE-2026-89929 · Linux kernel KVM nVMX (INVVPID emulation, wrong physical CPU)High
• KVM nVMX: vpid02 is not flushed on first use after VMXOFF/VMXON, reusing another VM's TLB entriesCVE-2026-89932 · Linux kernel KVM nVMX (vpid02 allocation, last_vpid reset)High
• Linux kernel dma-direct: dma_direct_alloc_pages() treats a CPU address as a struct page pointerCVE-2026-89995 · Linux kernel dma-direct (dma_direct_alloc_from_pool return type)High
• Linux iommu/vt-d: stale context-cache entry on alias teardown lets the IOMMU walk freed PASID tablesCVE-2026-90240 · Linux kernel iommu/vt-d (context-cache invalidation for DMA aliases)High
• Linux iommu/tegra241-cmdqv: multi-stream devices get incomplete vSID mapping, zero-stream devices read out of boundsCVE-2026-90425 · Linux kernel iommu/tegra241-cmdqv (vSID to Stream ID mapping)High
• Linux dw-edma: callbacks fire for terminated transfers, dereferencing freed client stateCVE-2026-93042 · Linux kernel dmaengine dw-edma (terminate-all descriptor handling)High