Bug 2510891 (CVE-2026-64561)

Summary:	CVE-2026-64561 kernel: KVM: x86: Check for invalid/obsolete root after making MMU pages available
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akito5623, elgueromexicano, rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in KVM in the Linux kernel. This vulnerability occurs due to improper validation of memory management unit (MMU) page roots after these pages are made available. An attacker could exploit this by triggering a scenario where KVM attempts to map memory into an invalid root, causing child shadow pages to inherit an invalid state. This violates KVM's internal integrity rules, potentially leading to system instability or a denial of service within the virtualized environment.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-04 07:02:12 UTC

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Check for invalid/obsolete root *after* making MMU pages available

Check for a "stale" page fault, i.e. for an invalid and/or obsolete root,
after making MMU pages available for the shadow MMU.  If reclaiming shadow
pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to
map memory into an invalid root.  On its own, populating an invalid root is
"fine", but because child shadow pages inherit their parent's role, any
children created during the map/fetch will be created as invalid pages,
thus violating KVM's invariant that invalid pages are never on the list of
active MMU pages.

Note, the underlying flaw has existed since KVM first started tracking
invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root
pagetables"), but the true badness only came along in 2020 (Linux 5.9)
with the invariant that invalid shadow pages can't be on the list of
active pages.

Note #2, inheriting role.invalid when creating child shadow pages is also
far from ideal; that flaw will be addressed separately.

Comment 1 Mauro Matteo Cascella 2026-08-04 09:21:09 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026080401-CVE-2026-64561-d0d4@gregkh/T

Comment 6 Akiyoshi Kurita 2026-08-06 21:26:54 UTC

Additional exploitability information:

A public PoC and full guest-to-host exploit demonstration for CVE-2026-64561 has been released:

https://github.com/V4bel/Zapscape

The repository includes poc.c, a kernel configuration, and a QEMU launch script. The demonstration reproduces the complete exploit chain under QEMU TCG and successfully creates the root-owned /Zapscape file on the KVM host.

The researcher states that this is not yet a directly weaponized cloud exploit, but that porting it to a real KVM environment would mainly require moving the guest-side actions into a kernel module and adapting the exploit to the host kernel configuration.

Could Red Hat please reassess the impact and severity in light of this public PoC, particularly the potential for guest-to-host root code execution and local privilege escalation on RHEL systems?