CVE-2026-68428

Name of the Vulnerable Software and Affected Versions Linux kernel version 7.1.3

Description A slab use-after-free issue exists in the KVM x86 MMU. The mmu destroy caches() function destroys pte list desc cache and mmu page header cache but fails to clear the associated pointers. Because these pointers reside in kvm.ko, they persist even after a vendor module is unloaded. If a subsequent attempt to load a vendor module fails during the creation of pte list desc cache, the error path triggers mmu destroy caches(). This results in a stale pointer for mmu page header cache being passed to kmem cache destroy(), leading to the use-after-free condition. This can be triggered during the kvm mmu vendor module init() function.

Recommendations Update Linux kernel version 7.1.3 to a version where the mmu destroy caches() function is updated to clear both pointers immediately after destroying their caches.