CVE-2026-63806

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A malicious guest in Linux KVM can crash the host system via Memory-Mapped I/O (MMIO). The issue occurs when a guest emits a store that splits a page starting at page offset N, and the second page has a datamatch-enabled ioeventfd at offset 0. In this scenario, KVM checks for datamatch using &dst.valptr[N] as the source. Because dst is 32-byte aligned, if N is not aligned to the length @len, a BUG ON() is triggered in the ioeventfd write() function, leading to a host kernel panic. This is caused by the system attempting to dereference an unaligned pointer, which is undefined behavior in C.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.