CVE-2026-23401

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.0-rc2-eafebd2d2ab0-sink-vm #319

Description A flaw was discovered in the Linux kernel's KVM component related to the handling of shadow-present SPTEs (Stale Page Table Entries) during the installation of emulated MMIO (Memory Mapped I/O) SPTEs. Specifically, the vulnerability occurs when an MMIO SPTE is installed without first dropping or zapping the existing shadow-present SPTE. This can lead to issues when host userspace modifies a shadowed gPTE to switch from a memslot to emulated MMIO, and the guest subsequently triggers a relevant page fault. The issue was identified during testing and is triggered by writes to guest memory outside the scope of KVM.

Recommendations Update the Linux kernel to a version newer than 7.0.0-rc2-eafebd2d2ab0-sink-vm #319.