CVE-2026-53359

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.1.3 Linux kernel versions prior to 6.18.38 Linux kernel versions prior to 6.12.95 Linux kernel versions prior to 6.6.144 Linux kernel versions prior to 6.1.177 Linux kernel versions prior to 5.15.211 Linux kernel versions prior to 5.10.260

Description A use-after-free issue exists in the x86 shadow MMU of the Kernel-based Virtual Machine (KVM) hypervisor. The flaw occurs when the rmap remove() function fails to remove recorded entries because it does not compare the role of a page when a modified Page Directory Entry (PDE) points to a non-leaf page. Specifically, if a large 2MB page creates a kvm mmu page with direct=1 and a new 4KB page requires direct=0, the kvm mmu get child sp() function reuses the page without verifying the role. Subsequently, kvm mmu page get gfn() computes the Guest Frame Number (GFN) incorrectly, leaving a surviving rmap entry after the shadow page is freed. This allows an attacker with root privileges in a guest VM to dereference a pointer in freed memory, potentially leading to a host kernel panic (denial of service) or guest-to-host escape with arbitrary code execution on the host. The issue affects both Intel and AMD x86 architectures and is particularly critical for multi-tenant public cloud environments using nested virtualization.

Recommendations Update the Linux kernel to versions 7.1.3, 6.18.38, 6.12.95, 6.6.144, 6.1.177, 5.15.211, or 5.10.260. As a mitigation measure, disable nested virtualization by setting kvm intel.nested=0 and kvm amd.nested=0 in the kernel boot arguments.