CVE-2026-80726

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80726", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "REJECTED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.789Z", "datePublished": "2026-09-03T08:21:45.923Z", "dateUpdated": "2026-10-20T13:15:30.500Z", "dateRejected": "2026-10-20T13:15:30.500Z"}, "containers": {"cna": {"rejectedReasons": [{"lang": "en", "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-20T13:15:30.500Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-80726", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:21:10.444243Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:21:11.319Z"}}], "cna": {"title": "KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only through host KVM x86 shadow-MMU handling on the KVM_RUN ioctl path (kvm_arch_vcpu_ioctl_run -> kvm_mmu_page_fault/kvm_mmu_load -> __kvm_mmu_get_shadow_page), driven by guest page faults and root reloads, not by remote network or physical input.\nAC:L - The reproducer (UID 1000) triggers this reliably by combining guest page-table churn with MMU reclaim (make_mmu_pages_available/kvm_mmu_zap_oldest_mmu_pages) so an in-use root is zapped invalid while children are still created; the attacker controls both fault and reclaim sides of the race.\nPR:N - Exploitation requires only code running inside an already-running KVM guest (or equivalent guest-driven KVM_RUN activity); no host root, CAP_SYS_ADMIN, or direct /dev/kvm access is needed beyond what any cloud VM tenant or compromised guest process already has.\nUI:N - Once the attacker can execute in the guest, triggering the fault/reclaim sequence is entirely self-driven through guest memory and paging behavior with no action required from another user or administrator.\nS:C - Corrupting host KVM MMU active_mmu_pages/list state from guest-controlled faults crosses the guest-to-host virtualization boundary and can compromise the host kernel beyond the guest security domain, enabling VM escape-class impact.\nC:H - The demonstrated slab use-after-free and broken active-list invariant (invalid children left linked while __kvm_mmu_prepare_zap_page uses list_add instead of list_move) provide attacker-influenced host heap corruption that can be leveraged for arbitrary kernel memory reads.\nI:H - The same UAF and doubly-linked list corruption on host kvm_mmu_page objects are writable memory-corruption primitives suitable for control-flow or structure hijacking, not merely benign accounting errors.\nA:H - KASAN reports a host slab UAF with an 8-byte write in __kvm_mmu_get_shadow_page, and list corruption on active_mmu_pages can cause host oops, panic, or hang, denying service to the host and co-located VMs."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a770f6f28b1a9287189f3dc8333eb694d9a2f0ab", "lessThan": "ec4eb5c2ef964bf398f07889265121c316561911", "versionType": "git"}, {"status": "affected", "version": "a770f6f28b1a9287189f3dc8333eb694d9a2f0ab", "lessThan": "9b7984692c18b22d6d61af3f53887fca7fddb0f1", "versionType": "git"}, {"status": "affected", "version": "a770f6f28b1a9287189f3dc8333eb694d9a2f0ab", "lessThan": "f33ecb89d352348ed5e625f6747ac51ede254e1b", "versionType": "git"}, {"status": "affected", "version": "a770f6f28b1a9287189f3dc8333eb694d9a2f0ab", "lessThan": "0af4711862c5b818204d40b21f0859ad51c230e9", "versionType": "git"}, {"status": "affected", "version": "a770f6f28b1a9287189f3dc8333eb694d9a2f0ab", "lessThan": "66bc868a33cf1de43f22a94acd8857e0fe33393f", "versionType": "git"}, {"status": "affected", "version": "a770f6f28b1a9287189f3dc8333eb694d9a2f0ab", "lessThan": "9f7760a2e962cbda0d096a27d394d14ad4d22928", "versionType": "git"}, {"status": "affected", "version": "a770f6f28b1a9287189f3dc8333eb694d9a2f0ab", "lessThan": "5ec42d57655c690234c14aece6dd3f209778c1d8", "versionType": "git"}], "programFiles": ["arch/x86/kvm/mmu/mmu.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.30"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.30", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.222", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.152", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.104", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.45", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/x86/kvm/mmu/mmu.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ec4eb5c2ef964bf398f07889265121c316561911"}, {"url": "https://git.kernel.org/stable/c/9b7984692c18b22d6d61af3f53887fca7fddb0f1"}, {"url": "https://git.kernel.org/stable/c/f33ecb89d352348ed5e625f6747ac51ede254e1b"}, {"url": "https://git.kernel.org/stable/c/0af4711862c5b818204d40b21f0859ad51c230e9"}, {"url": "https://git.kernel.org/stable/c/66bc868a33cf1de43f22a94acd8857e0fe33393f"}, {"url": "https://git.kernel.org/stable/c/9f7760a2e962cbda0d096a27d394d14ad4d22928"}, {"url": "https://git.kernel.org/stable/c/5ec42d57655c690234c14aece6dd3f209778c1d8"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page\n\nExplicitly clear role.invalid when deriving a child shadow page's role from\nits parent to harden against bugs elsewhere in KVM, as violating KVM's\ninvariant that invalid pages are NOT on the list of active MMU pages leads\nto use-after-free due to __kvm_mmu_prepare_zap_page() using list_add()\ninstead of list_move() when processing an invalid shadow page, i.e. makes a\nbad situation far worse.\n\nYell loudly if the parent is invalid, as it means KVM has missed a validity\ncheck, i.e. KVM is attempting to map memory using an invalid/obsolete root,\nbut continue on as the child is otherwise still a valid shadow page.\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in __kvm_mmu_get_shadow_page+0x1817/0x1860 [kvm]\n Write of size 8 at addr ff11000153dd1368 by task repro/853\n\n CPU: 1 UID: 1000 PID: 853 Comm: repro Not tainted 7.2.0-rc2-3aec122bdcaf-next-vm #5 PREEMPT\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n Call Trace:\n <TASK>\n dump_stack_lvl+0x4b/0x70\n print_report+0x153/0x49c\n kasan_report+0xbc/0xf0\n __kvm_mmu_get_shadow_page+0x1817/0x1860 [kvm]\n mmu_alloc_root+0x141/0x320 [kvm]\n kvm_mmu_load+0x612/0x20f0 [kvm]\n kvm_arch_vcpu_ioctl_run+0x3dd5/0x6150 [kvm]\n kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm]\n __x64_sys_ioctl+0x131/0x1b0\n do_syscall_64+0x67/0x5f0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n </TASK>\n\n Allocated by task 853:\n kasan_save_stack+0x20/0x40\n kasan_save_track+0x14/0x30\n __kasan_slab_alloc+0x5f/0x70\n kmem_cache_alloc_noprof+0xfe/0x2e0\n __kvm_mmu_topup_memory_cache+0x135/0x530 [kvm]\n paging64_page_fault+0x318/0x1e30 [kvm]\n kvm_mmu_do_page_fault+0x21d/0x630 [kvm]\n kvm_mmu_page_fault+0x18c/0x17b0 [kvm]\n kvm_arch_vcpu_ioctl_run+0x1f35/0x6150 [kvm]\n kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm]\n __x64_sys_ioctl+0x131/0x1b0\n do_syscall_64+0x67/0x5f0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n Freed by task 853:\n kasan_save_stack+0x20/0x40\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x43/0x70\n kmem_cache_free+0xe2/0x400\n kvm_mmu_commit_zap_page.part.0+0x1e2/0x310 [kvm]\n kvm_mmu_free_roots+0x283/0x560 [kvm]\n kvm_arch_vcpu_ioctl_run+0x33c8/0x6150 [kvm]\n kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm]\n __x64_sys_ioctl+0x131/0x1b0\n do_syscall_64+0x67/0x5f0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.222", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.152", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.104", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.45", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.9", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "2.6.30"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-03T10:56:07.809Z"}}}, "cveMetadata": {"cveId": "CVE-2026-80726", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:26:35.874Z", "dateReserved": "2026-08-26T14:34:25.789Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-09-03T08:21:45.923Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}], "id": "CVE-2026-80726", "lastModified": "2026-10-20T14:17:03.400", "metrics": {}, "published": "2026-09-03T13:06:11.020", "references": [], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Rejected"}

{"bugzilla": {"description": "kernel: KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page", "id": "2527858", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527858"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in KVM (Kernel-based Virtual Machine). This vulnerability occurs in the x86 Memory Management Unit (MMU) when creating a child shadow page. An attacker, potentially a malicious guest operating system, could exploit this by triggering a use-after-free condition due to incorrect handling of invalid memory pages. This could lead to system instability or a denial of service on the host system."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-80726", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-09-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80726\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80726\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80726.mbox"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a770f6f28b1a9287189f3dc8333eb694d9a2f0ab,9b7984692c18b22d6d61af3f53887fca7fddb0f1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a770f6f28b1a9287189f3dc8333eb694d9a2f0ab,f33ecb89d352348ed5e625f6747ac51ede254e1b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a770f6f28b1a9287189f3dc8333eb694d9a2f0ab,0af4711862c5b818204d40b21f0859ad51c230e9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a770f6f28b1a9287189f3dc8333eb694d9a2f0ab,66bc868a33cf1de43f22a94acd8857e0fe33393f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a770f6f28b1a9287189f3dc8333eb694d9a2f0ab,9f7760a2e962cbda0d096a27d394d14ad4d22928)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a770f6f28b1a9287189f3dc8333eb694d9a2f0ab,5ec42d57655c690234c14aece6dd3f209778c1d8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.30"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.30)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.183,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.152,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.104,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.45,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-03T12:30:03.815072+00:00", "updated": "2026-09-07T16:30:07.075948+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}