Look up another CVE · open CVE-2026-89928 in the interactive tracker
CVE-2026-89928
KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk
Published 2026-09-16 (33 days ago) by the Linux kernel CNA. Subsystem arch/x86. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-89928 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
__kvm_rmap_lock() deliberately elides the rmap lock when it observes an empty rmap. In that case kvm_rmap_lock_readonly() also re-enables preemption and returns zero, so the caller holds neither the rmap lock nor a preemption reference. The elision documents the invariant it relies on: * Elide the lock if the rmap is empty, as lockless walkers (read-only * mode) don't need to (and can't) walk an empty rmap, nor can they add * entries to the rmap. I.e. the only paths that process empty rmaps * do so while holding mmu_lock for write, and are mutually exclusive. kvm_rmap_age_gfn_range() ignores the returned value and unconditionally enters for_each_rmap_spte_lockless(). The iterator started with rmap_get_first(), which re-reads rmap_head->val rather than using the value returned by the lock. If a writer populates the rmap between the lock's read and the iterator's re-read, the aging path walks the newly installed rmap without holding its lock. For a KVM_RMAP_MANY rmap this leaves the walker following a pte_list_desc chain that it never locked. A writer holding mmu_lock for write may free that chain (e.g. kvm_zap_all_rmap_sptes() on the recycle path, or any rmap zap) via kmem_cache_free() while the walk is in progress, giving a slab use-after-free. Nothing serialises the two: the aging path runs without mmu_lock when CONFIG_KVM_MMU_LOCKLESS_AGING=y, and the rmap lock that would otherwise exclude the writer was elided. Because the empty path re-enables preemption, the interval between the two reads can span an arbitrary scheduling delay. Fix the class of bug by having the lockless walk consume the value returned by the lock instead of re-reading the rmap. Split rmap_get_first() into __rmap_get_first(), which starts an iterator from an already-read rmap value, and make for_each_rmap_spte_lockless() take that value and call __rmap_get_first() directly. kvm_rmap_age_gfn_range() passes the value returned by kvm_rmap_lock_readonly(): when the lock was elided the value is zero, __rmap_get_first() returns NULL, and the walk is skipped. No lockless walker re-reads the rmap, so the lock-elision invariant cannot be violated, and no lock()-without-paired-unlock() path is added to the aging code.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
arch/x86/kvm/mmu/mmu.c
- What this is
- KERNEL VIRTUAL MACHINE FOR X86 (KVM/x86)MAINTAINERS section matched on arch/x86/kvm/*/ · kvm@vger.kernel.org · Supported
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-09-16 (33 days ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 5.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- arch/x86
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.15 | 6.18.51 | 41debfc98526 |
| 6.15 | 7.2.5 | 8edb3c09e43f |
| 6.15 | 7.3 | e428f9779a43 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The UAF is reached only through local KVM: MMU notifiers on the VM mm (clear_young/clear_flush_young/test_young → kvm_age_gfn → kvm_rmap_age_gfn_range) racing with KVM_RUN shadow-MMU rmap updates. There is no network, adjacent-radio, or physical-device path.
- AC:LAttack complexity, low
- The attacker controls both sides: KVM_RUN/nested EPT faults populate an empty rmap to KVM_RMAP_MANY and later zap it, while reclaim of the same process's guest RAM runs the lockless walker. Lockless aging is default on x86 KVM, nested=1 is default, and eliding the empty-rmap lock re-enables preemption so the TOCTOU window is large.
- PR:LPrivileges required, low
- Exploitation requires /dev/kvm (typically kvm-group QEMU/libvirt) or a nested-capable x86 guest, not init-namespace root. KVM_CREATE_VM and KVM_RUN have no capable() check; kvm-group membership is unprivileged device access.
- UI:NUser interaction, none
- Once the attacker can run the VM, they drive rmap populate/zap and host aging of their own guest memory with no separate victim action such as mounting a filesystem or opening a file.
- S:CScope, changed
- The UAF runs in the host KVM MMU while walking guest/nested shadow SPTEs and frees host pte_list_desc slab objects, corrupting kernel state beyond the guest VM. That is a KVM guest-to-host escape-class boundary crossing.
- C:HConfidentiality impact, high
- A writer may kmem_cache_free() the pte_list_desc chain while the lockless ager still walks it, which is a host slab use-after-free. After spray, desc->sptes[] and the subsequent SPTE reads become attacker-influenced kernel reads.
- I:HIntegrity impact, high
- kvm_rmap_age_gfn_range then clear_bit() or cmpxchg64() through the UAF-derived sptep to drop Accessed bits or mark access-track, yielding a host kernel write primitive suitable for control-flow hijacking.
- A:HAvailability impact, high
- A slab use-after-free on pte_list_desc during the lockless walk can oops or panic the host kernel, and a malicious guest can retrigger it, denying service to the host and co-resident VMs.