Look up another CVE · open CVE-2026-64561 in the interactive tracker
CVE-2026-64561
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
Published 2026-08-04 (2 months ago) by the Linux kernel CNA. Subsystem arch/x86. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-64561 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6415-1 · 2026-08-06 · text | 6.12.101-1 | Update the kernel and reboot. DSA-6415-1 shipped the fix on 2026-08-06, in 6.12.101-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.6-1 | Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.6-1 | Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4745-1 · 2026-08-18 · text | 6.12.101-1~deb12u1 | Update the kernel and reboot. DLA-4745-1 shipped the fix on 2026-08-18, in 6.12.101-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to map memory into an invalid root. On its own, populating an invalid root is "fine", but because child shadow pages inherit their parent's role, any children created during the map/fetch will be created as invalid pages, thus violating KVM's invariant that invalid pages are never on the list of active MMU pages. Note, the underlying flaw has existed since KVM first started tracking invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root pagetables"), but the true badness only came along in 2020 (Linux 5.9) with the invariant that invalid shadow pages can't be on the list of active pages. Note #2, inheriting role.invalid when creating child shadow pages is also far from ideal; that flaw will be addressed separately.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
arch/x86/kvm/mmu/mmu.c
arch/x86/kvm/mmu/paging_tmpl.h
- What this is
- KERNEL VIRTUAL MACHINE FOR X86 (KVM/x86)MAINTAINERS section matched on arch/x86/kvm/*/ · kvm@vger.kernel.org · Supported
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid, bookworm · linux-6.12?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-08-04 (2 months ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.35%, higher than 26.7% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- arch/x86
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.9 | 5.15.218 | 62ef67af1878 |
| 5.9 | 6.1.183 | 65c4f7a1028c |
| 5.9 | 6.6.148 | 35e77467610c |
| 5.9 | 6.12.101 | 0026dbb7de8e |
| 5.9 | 6.18.42 | f3477a6a4164 |
| 5.9 | 7.1.6 | bce0d3c26e2c |
| 5.9 | 7.2 | 2abd5287f083 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
| DLA-4745-1 | 2026-08-18 | bookworm 6.12.101-1~deb12u1 | tracker |
| DSA-6415-1 | 2026-08-06 | trixie 6.12.101-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable shadow-MMU page-fault path is reached via local KVM_RUN handling of guest EPT/shadow faults (and nested EPT via paging_tmpl), not by network or adjacent-radio packets.
- AC:LAttack complexity, low
- An attacker who can run nested or shadow-MMU guests controls MMU pressure (heavy nested mappings and/or KVM_SET_NR_MMU_PAGES) and concurrent faults so reclaim zaps an in-use root during make_mmu_pages_available; no attacker-uncontrollable condition is required.
- PR:LPrivileges required, low
- Exploitation needs /dev/kvm access or a nested-capable guest on the host, privileges commonly available to kvm-group users or cloud tenants, not real init-namespace root or CAP_SYS_ADMIN on the create/run path.
- UI:NUser interaction, none
- Once the attacker can run the guest, they trigger reclaim and page faults entirely through their own vCPU activity with no action by another user.
- S:CScope, changed
- Guest-controlled faults corrupt host KVM MMU state (invalid shadow pages on active_mmu_pages and subsequent list handling), crossing the guest-to-host virtualization boundary into the host kernel authority.
- C:HConfidentiality impact, high
- Invalid children on active_mmu_pages break zap accounting assumptions so later prepare_zap list_add on still-linked entries corrupts kernel lists, a memory-corruption primitive that can be leveraged for arbitrary host reads.
- I:HIntegrity impact, high
- The same active-list invariant break and linked-list corruption in host MMU teardown/reclaim paths yield writable host corruption suitable for control-flow or structure hijacking, not merely a benign accounting glitch.
- A:HAvailability impact, high
- WARN_ON_ONCE skips, infinite zap loops, list corruption, and host oops/hangs are reachable when invalid shadow pages remain on active_mmu_pages, causing host and co-located VM denial of service.