CVE-2026-23432

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23432", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.016Z", "datePublished": "2026-04-03T15:15:18.061Z", "dateUpdated": "2026-08-05T12:21:43.430Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:21:43.430Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmshv: Fix use-after-free in mshv_map_user_memory error path\n\nIn the error path of mshv_map_user_memory(), calling vfree() directly on\nthe region leaves the MMU notifier registered. When userspace later unmaps\nthe memory, the notifier fires and accesses the freed region, causing a\nuse-after-free and potential kernel panic.\n\nReplace vfree() with mshv_partition_put() to properly unregister\nthe MMU notifier before freeing the region."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached through local `/dev/mshv` and partition-file ioctls, specifically `MSHV_SET_GUEST_MEMORY`, not via network or adjacent protocols.\nAC:L - The attacker controls the memory-region parameters and can subsequently unmap the userspace range to fire the stale MMU notifier. No attacker-uncontrolled race or special victim state is required.\nPR:L - The attacker needs local access to the mshv device or an already-created partition fd, but the vulnerable ioctl itself has no `capable()` check. In a reasonable VMM deployment where that fd/device is granted to a service process, this is Low rather than High.\nUI:N - After obtaining the local mshv interface, the attacker can issue the ioctl and unmap memory without requiring any separate user action.\nS:U - The bug corrupts kernel memory through a kernel driver interface and impacts the same kernel security authority. This is not a guest-to-host escape path from inside a VM.\nC:H - This is a use-after-free of a registered MMU interval notifier embedded in `struct mshv_mem_region`. Reuse of the freed vmalloc object can plausibly expose kernel memory or support read primitives.\nI:H - The stale notifier callback dereferences and writes through fields of freed attacker-reclaimable kernel memory, including notifier sequence and region state. As a kernel UAF, it is plausibly exploitable for memory corruption or control-flow impact.\nA:H - The upstream fix explicitly notes that later userspace unmapping can fire the notifier on freed memory and cause a kernel panic. A local attacker can trigger this repeatedly for host denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hv/mshv_root_main.c"], "versions": [{"version": "b9a66cd5ccbb9fade15d0e427e19470d8ad35b75", "lessThan": "34861bdc0c0196b6c2dd48f7454029407704ff6e", "status": "affected", "versionType": "git"}, {"version": "b9a66cd5ccbb9fade15d0e427e19470d8ad35b75", "lessThan": "6922db250422a0dfee34de322f86b7a73d713d33", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hv/mshv_root_main.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.10", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/34861bdc0c0196b6c2dd48f7454029407704ff6e"}, {"url": "https://git.kernel.org/stable/c/6922db250422a0dfee34de322f86b7a73d713d33"}], "title": "mshv: Fix use-after-free in mshv_map_user_memory error path", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/hv/mshv_root_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "34861bdc0c0196b6c2dd48f7454029407704ff6e", "status": "affected", "version": "b9a66cd5ccbb9fade15d0e427e19470d8ad35b75", "versionType": "git"}, {"lessThan": "6922db250422a0dfee34de322f86b7a73d713d33", "status": "affected", "version": "b9a66cd5ccbb9fade15d0e427e19470d8ad35b75", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/hv/mshv_root_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D70DEFFE-AC47-4F3A-A2B2-2D67AB4CF3C8", "versionEndExcluding": "6.19.10", "versionStartIncluding": "6.19.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*", "matchCriteriaId": "35C8A871-4971-433E-A046-FC9F7B7D190A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmshv: Fix use-after-free in mshv_map_user_memory error path\n\nIn the error path of mshv_map_user_memory(), calling vfree() directly on\nthe region leaves the MMU notifier registered. When userspace later unmaps\nthe memory, the notifier fires and accesses the freed region, causing a\nuse-after-free and potential kernel panic.\n\nReplace vfree() with mshv_partition_put() to properly unregister\nthe MMU notifier before freeing the region."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nmshv: Correcci\u00f3n de uso despu\u00e9s de liberaci\u00f3n en la ruta de error de mshv_map_user_memory\n\nEn la ruta de error de mshv_map_user_memory(), llamar a vfree() directamente sobre la regi\u00f3n deja el notificador de MMU registrado. Cuando el espacio de usuario (userspace) desmapea la memoria m\u00e1s tarde, el notificador se activa y accede a la regi\u00f3n liberada, causando un uso despu\u00e9s de liberaci\u00f3n y un potencial p\u00e1nico del kernel.\n\nReemplace vfree() con mshv_partition_put() para anular correctamente el registro del notificador de MMU antes de liberar la regi\u00f3n."}], "id": "CVE-2026-23432", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-03T16:16:24.637", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/34861bdc0c0196b6c2dd48f7454029407704ff6e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6922db250422a0dfee34de322f86b7a73d713d33"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: mshv: Fix use-after-free in mshv_map_user_memory error path", "id": "2454869", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454869"}, "csaw": false, "cwe": "CWE-763", "details": ["A flaw was found in the Linux kernel's mshv component. A local user could exploit a use-after-free vulnerability by unmapping memory after a specific error path in the `mshv_map_user_memory` function. This can cause a system crash (kernel panic) due to the system attempting to access freed memory."], "name": "CVE-2026-23432", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23432\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23432\nhttps://lore.kernel.org/linux-cve-announce/2026040311-CVE-2026-23432-4aaf@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b9a66cd5ccbb9fade15d0e427e19470d8ad35b75,34861bdc0c0196b6c2dd48f7454029407704ff6e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b9a66cd5ccbb9fade15d0e427e19470d8ad35b75,6922db250422a0dfee34de322f86b7a73d713d33)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.10,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T21:49:22.828866+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a version that includes the commit fixing the use\u2011after\u2011free bug (see the referenced kernel commit URLs).", "If an immediate kernel upgrade is not possible, consider disabling or limiting hypervisor memory mapping features until the fix is applied.", "Monitor system logs for kernel panic incidents that may indicate an exploitation of the use\u2011after\u2011free flaw."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service via kernel panic"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Linux kernel in all versions that contain the buggy implementation of mshv_map_user_memory. The fix is present only after the patches released in the kernel commit referenced in the advisory. No specific version range is listed, so any kernel that has not yet been updated to include the fix remains potentially vulnerable.", "description_and_impact": "A use\u2011after\u2011free flaw exists in the error path of the Linux kernel\u2019s mshv_map_user_memory() function. When the function calls vfree() on a memory region that still has an MMU notifier registered, the notifier remains active. If userspace later unmaps the memory, the notifier fires and touches the freed memory, causing a use\u2011after\u2011free and potentially a kernel panic. The flaw can be triggered by malformed hypervisor memory mapping requests and leads to a denial of service by crashing the kernel.", "risk_and_exploitability": "The CVSS score of 7.8 indicates high severity. The exploit probability is reported as less than 1\u202f% according to EPSS, and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation. However, once triggered, the impact is a complete system crash. The likely attack vector involves exploiting the hypervisor interface from userspace or privileged clients, requiring a successful call to mshv_map_user_memory with crafted parameters. Because the flaw resides in kernel memory management, no privilege escalation to arbitrary code execution is described; the primary risk is denial of service."}}}}, "created": "2026-04-03T21:14:05.991245+00:00", "updated": "2026-04-28T22:00:14.119010+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}