KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level When recovering hugepages in the shadow MMU, verify that the base gfn of the shadow page is actually contained within the target memslot, *before* querying the max mapping level given the shadow page's gfn. Failure to pre-check the validity of the gfn can lead to an out-of-bounds access to the slot's lpage_info (which typically manifests as a host #PF because the lpage_info is vmalloc'd) if the guest creates a hugepage mapping (in its PTEs) that extends "below" the bounds of a memslot. When faulting in memory for a guest, and the size of the guest mapping is greater than KVM's (current) max mapping, then KVM will create a "direct" shadow page (direct in that there are no gPTEs to shadow, and so the target gfn is a direct calculation given the base gfn of the shadow page). The hugepage recovery flow looks for such direct shadow pages, as forcing 4KiB mappings when dirty logging generates the guest > host mapping size case. When the 4KiB restriction is lifted, then KVM can replace the shadow page with a hugepage. But if KVM originally used a smaller mapping than the guest because the range of memory covered by the guest hugepage exceeds the bounds of a memslot, then KVM will link a direct shadow page with a gfn that is outside the bounds of the memslot being used to fault in memory. The rmap entry added for the leaf mapping is correct
CVE-2026-63807
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-63807
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "9eba50f8d7fcb61774f160890f98239fa3ab68a6",
"lessThan": "7b52008023b7facf40fba3ebe92449bda8ea53b9",
"versionType": "git"
},
{
"status": "affected",
"version": "9eba50f8d7fcb61774f160890f98239fa3ab68a6",
"lessThan": "5cab1c989f938f5e1b9a0de66486f1fc2c28479b",
"versionType": "git"
},
{
"status": "affected",
"version": "9eba50f8d7fcb61774f160890f98239fa3ab68a6",
"lessThan": "48b91ed7e22bb82571c34f8b80b6ecdc90a6fab8",
"versionType": "git"
},
{
"status": "affected",
"version": "9eba50f8d7fcb61774f160890f98239fa3ab68a6",
"lessThan": "c5c29b3c268332afe67d598a034c58344540ed92",
"versionType": "git"
},
{
"status": "affected",
"version": "9eba50f8d7fcb61774f160890f98239fa3ab68a6",
"lessThan": "18587f9831612e24cd8f24be1ec15478feff7abc",
"versionType": "git"
},
{
"status": "affected",
"version": "9eba50f8d7fcb61774f160890f98239fa3ab68a6",
"lessThan": "b2ae3245ea44dccaa9af676b6747476951883318",
"versionType": "git"
},
{
"status": "affected",
"version": "9eba50f8d7fcb61774f160890f98239fa3ab68a6",
"lessThan": "ef057cbf825e03b63f6edf5980f96abf3c53089d",
"versionType": "git"
}
],
"programFiles": [
"arch/x86/kvm/mmu/mmu.c",
"include/linux/kvm_host.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.12",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"arch/x86/kvm/mmu/mmu.c",
"include/linux/kvm_host.h"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-63807
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #40835 · Revision 1
- Added to Heist Feed
- Publisher date