CVE-2026-53359

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.1.3 Linux kernel versions prior to 6.18.38 Linux kernel versions prior to 6.12.95 Linux kernel versions prior to 6.6.144 Linux kernel versions prior to 6.1.177 Linux kernel versions prior to 5.15.211 Linux kernel versions prior to 5.10.260

Description A use-after-free flaw exists in the x86 shadow MMU (Memory Management Unit) of the Kernel-based Virtual Machine (KVM) subsystem. The issue occurs in the rmap remove() function when a shadow paging mismatch occurs between stored and computed Guest Frame Numbers (GFNs). Specifically, if a modified Page Directory Entry (PDE) points to a non-leaf page, the kvm mmu get child sp() function fails to compare the role of the page and reuses it. When a memslot is dropped, the shadow page is freed, but the rmap entry survives. Subsequent operations, such as dirty logging or MMU notifier invalidation, dereference a pointer to the freed page. This can be exploited by a guest VM with root privileges to cause a host kernel panic (denial of service) or achieve guest-to-host escape to execute arbitrary code with root privileges on the host. The flaw affects both Intel and AMD CPUs and has been present in the kernel for approximately 16 years.

Recommendations Update the Linux kernel to version 7.1.3, 6.18.38, 6.12.95, 6.6.144, 6.1.177, 5.15.211, or 5.10.260. As a temporary mitigation, disable nested virtualization by setting kvm intel.nested=0 and kvm amd.nested=0 in the kernel boot arguments or via modprobe configuration.