CVE-2026-63807

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds access issue exists in the Linux kernel KVM x86 MMU during hugepage recovery in the shadow MMU. The issue occurs when the system fails to verify that the base guest frame number (gfn) of a shadow page is contained within the target memslot before querying the maximum mapping level. If a guest creates a hugepage mapping that extends below the bounds of a memslot, it can lead to an out-of-bounds access to the slot's lpage info, typically resulting in a host page fault (#PF) and a system crash. This specifically affects the kvm mmu max mapping level() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.