Skip to content
Heist/ feed
UnratedFix available

KVM: x86/mmu: Fix use-after-free on vendor module reload

Type: advisorySource: OSV1 source record

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module reload mmu_destroy_caches() destroys pte_list_desc_cache and mmu_page_header_cache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor module is unloaded while kvm.ko remains loaded. If creation of pte_list_desc_cache fails during a subsequent vendor module load, its assignment sets pte_list_desc_cache to NULL and the error path calls mmu_destroy_caches(). mmu_page_header_cache still points to the cache destroyed during the preceding vendor module unload. Passing that stale pointer to kmem_cache_destroy() causes a slab use-after-free. Reproduce the issue on a v7.1.3 kernel with CONFIG_KASAN=y, CONFIG_KASAN_GENERIC=y, CONFIG_KVM=m, and CONFIG_KVM_INTEL=m. A one-shot test hook forces pte_list_desc_cache to NULL on the second invocation of kvm_mmu_vendor_module_init(): 1. Load kvm.ko and kvm-intel.ko, creating both caches. 2. Unload only kvm_intel, leaving kvm.ko loaded. 3. Reload kvm_intel and force initialization through the -ENOMEM path. KASAN reports: BUG: KASAN: slab-use-after-free in kvm_mmu_vendor_module_init+0x5b/0x170 [kvm] ... kmem_cache_destroy+0x21/0x1d0 kvm_mmu_vendor_module_init+0x5b/0x170 [kvm] ... Allocated by task 16817: __kmem_cache_create_args+0x12c/0x3b0 __kmem_cache_create.constprop.0+0xb6/0xf0 [kvm] kvm_mmu_vendor_module_init+0x13b/0x170 [kvm] ... Freed by task 16820: kmem_cache_destroy+0x117

Announced Source revision 1
Original source ↗

CVE-2026-68428

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:CVE-2026-68428

Kernel

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
5.10.265

Source reference: /affected/1/ranges

5.15.216

Source reference: /affected/1/ranges

6.1.183

Source reference: /affected/1/ranges

6.6.148

Source reference: /affected/1/ranges

6.12.101

Source reference: /affected/1/ranges

6.18.42

Source reference: /affected/1/ranges

7.1.6

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
        "type": "GIT",
        "events": [
          {
            "introduced": "cb498ea2ce1d3f3c0bc0a2522241dca10263e437"
          },
          {
            "fixed": "034b7fa1f5846d69eb51f12ce6d1c71871e83c2d"
          },
          {
            "fixed": "42272b0f239f3a89f9c26a01cc37aee06138b1b7"
          },
          {
            "fixed": "940950d5cd86f250dca578279ad5ca63b4e0986b"
          },
          {
            "fixed": "6f4be73880302d5642c83a0813fdfe1f5fd4b6e3"
          },
          {
            "fixed": "32b9f89ed9e6d7a45075d64089c254a7f6e13695"
          },
          {
            "fixed": "ec9daa8fd1b6f45545c9839dca55bd867fad9e13"
          },
          {
            "fixed": "43cfb20d62ffe49626d62beecfc32eb6f262191c"
          },
          {
            "fixed": "52f2f7c30126037975389aa04d24c506a5177c35"
          }
        ]
      }
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68428.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "2.6.25"
          },
          {
            "fixed": "5.10.265"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "5.11.0"
          },
          {
            "fixed": "5.15.216"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "5.16.0"
          },
          {
            "fixed": "6.1.183"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.2.0"
          },
          {
            "fixed": "6.6.148"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.7.0"
          },
          {
            "fixed": "6.12.101"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.13.0"
          },
          {
            "fixed": "6.18.42"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.19.0"
          },
          {
            "fixed": "7.1.6"
          }
        ]
      }
    ],
    "package": {
      "name": "Kernel",
      "ecosystem": "Linux"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68428.json"
    }
  }
]
Related CVEs
CVE-2026-68428

Source reference: /id

Publisher severity

No explicit severity was provided.

Event
#50673 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement