Bug 2510891 (CVE-2026-64561) - CVE-2026-64561 kernel: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
Summary: CVE-2026-64561 kernel: KVM: x86: Check for invalid/obsolete root *after* maki...
Keywords:
Status: NEW
Alias: CVE-2026-64561
Product: Security Response
Classification: Other
Component: vulnerability-draft
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-04 07:02 UTC by OSIDB Bzimport
Modified: 2026-08-07 14:15 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-04 07:02:12 UTC
In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Check for invalid/obsolete root *after* making MMU pages available

Check for a "stale" page fault, i.e. for an invalid and/or obsolete root,
after making MMU pages available for the shadow MMU.  If reclaiming shadow
pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to
map memory into an invalid root.  On its own, populating an invalid root is
"fine", but because child shadow pages inherit their parent's role, any
children created during the map/fetch will be created as invalid pages,
thus violating KVM's invariant that invalid pages are never on the list of
active MMU pages.

Note, the underlying flaw has existed since KVM first started tracking
invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root
pagetables"), but the true badness only came along in 2020 (Linux 5.9)
with the invariant that invalid shadow pages can't be on the list of
active pages.

Note #2, inheriting role.invalid when creating child shadow pages is also
far from ideal; that flaw will be addressed separately.

Comment 1 Mauro Matteo Cascella 2026-08-04 09:21:09 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026080401-CVE-2026-64561-d0d4@gregkh/T

Comment 6 Akiyoshi Kurita 2026-08-06 21:26:54 UTC
Additional exploitability information:

A public PoC and full guest-to-host exploit demonstration for CVE-2026-64561 has been released:

https://github.com/V4bel/Zapscape

The repository includes poc.c, a kernel configuration, and a QEMU launch script. The demonstration reproduces the complete exploit chain under QEMU TCG and successfully creates the root-owned /Zapscape file on the KVM host.

The researcher states that this is not yet a directly weaponized cloud exploit, but that porting it to a real KVM environment would mainly require moving the guest-side actions into a kernel module and adapting the exploit to the host kernel configuration.

Could Red Hat please reassess the impact and severity in light of this public PoC, particularly the potential for guest-to-host root code execution and local privilege escalation on RHEL systems?


Note You need to log in before you can comment on or make changes to this bug.