CVE-2026-80726 (GCVE-0-2026-80726)
Vulnerability from cvelistv5

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-10-20T13:15:30.500Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80726",
    "datePublished": "2026-09-03T08:21:45.923Z",
    "dateRejected": "2026-10-20T13:15:30.500Z",
    "dateReserved": "2026-08-26T14:34:25.789Z",
    "dateUpdated": "2026-10-20T13:15:30.500Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-80726\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-16T19:21:10.444243Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-16T19:21:11.319Z\"}}], \"cna\": {\"title\": \"KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.3, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached only through host KVM x86 shadow-MMU handling on the KVM_RUN ioctl path (kvm_arch_vcpu_ioctl_run -\u003e kvm_mmu_page_fault/kvm_mmu_load -\u003e __kvm_mmu_get_shadow_page), driven by guest page faults and root reloads, not by remote network or physical input.\\nAC:L - The reproducer (UID 1000) triggers this reliably by combining guest page-table churn with MMU reclaim (make_mmu_pages_available/kvm_mmu_zap_oldest_mmu_pages) so an in-use root is zapped invalid while children are still created; the attacker controls both fault and reclaim sides of the race.\\nPR:N - Exploitation requires only code running inside an already-running KVM guest (or equivalent guest-driven KVM_RUN activity); no host root, CAP_SYS_ADMIN, or direct /dev/kvm access is needed beyond what any cloud VM tenant or compromised guest process already has.\\nUI:N - Once the attacker can execute in the guest, triggering the fault/reclaim sequence is entirely self-driven through guest memory and paging behavior with no action required from another user or administrator.\\nS:C - Corrupting host KVM MMU active_mmu_pages/list state from guest-controlled faults crosses the guest-to-host virtualization boundary and can compromise the host kernel beyond the guest security domain, enabling VM escape-class impact.\\nC:H - The demonstrated slab use-after-free and broken active-list invariant (invalid children left linked while __kvm_mmu_prepare_zap_page uses list_add instead of list_move) provide attacker-influenced host heap corruption that can be leveraged for arbitrary kernel memory reads.\\nI:H - The same UAF and doubly-linked list corruption on host kvm_mmu_page objects are writable memory-corruption primitives suitable for control-flow or structure hijacking, not merely benign accounting errors.\\nA:H - KASAN reports a host slab UAF with an 8-byte write in __kvm_mmu_get_shadow_page, and list corruption on active_mmu_pages can cause host oops, panic, or hang, denying service to the host and co-located VMs.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"a770f6f28b1a9287189f3dc8333eb694d9a2f0ab\", \"lessThan\": \"ec4eb5c2ef964bf398f07889265121c316561911\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a770f6f28b1a9287189f3dc8333eb694d9a2f0ab\", \"lessThan\": \"9b7984692c18b22d6d61af3f53887fca7fddb0f1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a770f6f28b1a9287189f3dc8333eb694d9a2f0ab\", \"lessThan\": \"f33ecb89d352348ed5e625f6747ac51ede254e1b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a770f6f28b1a9287189f3dc8333eb694d9a2f0ab\", \"lessThan\": \"0af4711862c5b818204d40b21f0859ad51c230e9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a770f6f28b1a9287189f3dc8333eb694d9a2f0ab\", \"lessThan\": \"66bc868a33cf1de43f22a94acd8857e0fe33393f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a770f6f28b1a9287189f3dc8333eb694d9a2f0ab\", \"lessThan\": \"9f7760a2e962cbda0d096a27d394d14ad4d22928\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a770f6f28b1a9287189f3dc8333eb694d9a2f0ab\", \"lessThan\": \"5ec42d57655c690234c14aece6dd3f209778c1d8\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/x86/kvm/mmu/mmu.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.30\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.30\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.222\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.183\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.152\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.104\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.45\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"7.1.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.1.*\"}, {\"status\": \"unaffected\", \"version\": \"7.2\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/x86/kvm/mmu/mmu.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ec4eb5c2ef964bf398f07889265121c316561911\"}, {\"url\": \"https://git.kernel.org/stable/c/9b7984692c18b22d6d61af3f53887fca7fddb0f1\"}, {\"url\": \"https://git.kernel.org/stable/c/f33ecb89d352348ed5e625f6747ac51ede254e1b\"}, {\"url\": \"https://git.kernel.org/stable/c/0af4711862c5b818204d40b21f0859ad51c230e9\"}, {\"url\": \"https://git.kernel.org/stable/c/66bc868a33cf1de43f22a94acd8857e0fe33393f\"}, {\"url\": \"https://git.kernel.org/stable/c/9f7760a2e962cbda0d096a27d394d14ad4d22928\"}, {\"url\": \"https://git.kernel.org/stable/c/5ec42d57655c690234c14aece6dd3f209778c1d8\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page\\n\\nExplicitly clear role.invalid when deriving a child shadow page\u0027s role from\\nits parent to harden against bugs elsewhere in KVM, as violating KVM\u0027s\\ninvariant that invalid pages are NOT on the list of active MMU pages leads\\nto use-after-free due to __kvm_mmu_prepare_zap_page() using list_add()\\ninstead of list_move() when processing an invalid shadow page, i.e. makes a\\nbad situation far worse.\\n\\nYell loudly if the parent is invalid, as it means KVM has missed a validity\\ncheck, i.e. KVM is attempting to map memory using an invalid/obsolete root,\\nbut continue on as the child is otherwise still a valid shadow page.\\n\\n  ==================================================================\\n  BUG: KASAN: slab-use-after-free in __kvm_mmu_get_shadow_page+0x1817/0x1860 [kvm]\\n  Write of size 8 at addr ff11000153dd1368 by task repro/853\\n\\n  CPU: 1 UID: 1000 PID: 853 Comm: repro Not tainted 7.2.0-rc2-3aec122bdcaf-next-vm #5 PREEMPT\\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x4b/0x70\\n   print_report+0x153/0x49c\\n   kasan_report+0xbc/0xf0\\n   __kvm_mmu_get_shadow_page+0x1817/0x1860 [kvm]\\n   mmu_alloc_root+0x141/0x320 [kvm]\\n   kvm_mmu_load+0x612/0x20f0 [kvm]\\n   kvm_arch_vcpu_ioctl_run+0x3dd5/0x6150 [kvm]\\n   kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm]\\n   __x64_sys_ioctl+0x131/0x1b0\\n   do_syscall_64+0x67/0x5f0\\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\\n   \u003c/TASK\u003e\\n\\n  Allocated by task 853:\\n   kasan_save_stack+0x20/0x40\\n   kasan_save_track+0x14/0x30\\n   __kasan_slab_alloc+0x5f/0x70\\n   kmem_cache_alloc_noprof+0xfe/0x2e0\\n   __kvm_mmu_topup_memory_cache+0x135/0x530 [kvm]\\n   paging64_page_fault+0x318/0x1e30 [kvm]\\n   kvm_mmu_do_page_fault+0x21d/0x630 [kvm]\\n   kvm_mmu_page_fault+0x18c/0x17b0 [kvm]\\n   kvm_arch_vcpu_ioctl_run+0x1f35/0x6150 [kvm]\\n   kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm]\\n   __x64_sys_ioctl+0x131/0x1b0\\n   do_syscall_64+0x67/0x5f0\\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\\n\\n  Freed by task 853:\\n   kasan_save_stack+0x20/0x40\\n   kasan_save_track+0x14/0x30\\n   kasan_save_free_info+0x3b/0x60\\n   __kasan_slab_free+0x43/0x70\\n   kmem_cache_free+0xe2/0x400\\n   kvm_mmu_commit_zap_page.part.0+0x1e2/0x310 [kvm]\\n   kvm_mmu_free_roots+0x283/0x560 [kvm]\\n   kvm_arch_vcpu_ioctl_run+0x33c8/0x6150 [kvm]\\n   kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm]\\n   __x64_sys_ioctl+0x131/0x1b0\\n   do_syscall_64+0x67/0x5f0\\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.222\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.183\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.152\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.104\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.45\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.1.9\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.2\", \"versionStartIncluding\": \"2.6.30\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-10-03T10:56:07.809Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-80726\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-16T19:26:35.874Z\", \"dateReserved\": \"2026-08-26T14:34:25.789Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-09-03T08:21:45.923Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.