Fedora Account System
Red Hat Associate
Red Hat Customer
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2026070403-CVE-2026-53359-4f57@gregkh/T
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:36956 https://access.redhat.com/errata/RHSA-2026:36956
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:36957 https://access.redhat.com/errata/RHSA-2026:36957
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:37729 https://access.redhat.com/errata/RHSA-2026:37729
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:38902 https://access.redhat.com/errata/RHSA-2026:38902
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:39082 https://access.redhat.com/errata/RHSA-2026:39082
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:39083 https://access.redhat.com/errata/RHSA-2026:39083
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:39371 https://access.redhat.com/errata/RHSA-2026:39371
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:39983 https://access.redhat.com/errata/RHSA-2026:39983
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:40082 https://access.redhat.com/errata/RHSA-2026:40082
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:41229 https://access.redhat.com/errata/RHSA-2026:41229
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.22 Via RHSA-2026:40764 https://access.redhat.com/errata/RHSA-2026:40764
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.21 Via RHSA-2026:40779 https://access.redhat.com/errata/RHSA-2026:40779
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.20 Via RHSA-2026:40787 https://access.redhat.com/errata/RHSA-2026:40787
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:43826 https://access.redhat.com/errata/RHSA-2026:43826
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:43825 https://access.redhat.com/errata/RHSA-2026:43825
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Via RHSA-2026:43847 https://access.redhat.com/errata/RHSA-2026:43847
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:44003 https://access.redhat.com/errata/RHSA-2026:44003
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:44006 https://access.redhat.com/errata/RHSA-2026:44006
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:44007 https://access.redhat.com/errata/RHSA-2026:44007
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:44004 https://access.redhat.com/errata/RHSA-2026:44004
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.19 Via RHSA-2026:44231 https://access.redhat.com/errata/RHSA-2026:44231
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.18 Via RHSA-2026:44230 https://access.redhat.com/errata/RHSA-2026:44230
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:49033 https://access.redhat.com/errata/RHSA-2026:49033
A public proof-of-concept repository for Januscape has been published: https://github.com/V4bel/Januscape The repository appears to include runnable code and reproduction instructions for the vulnerability. Could you please consider the public PoC availability when assessing exploitability and affected RHEL products?