CVE-2026-80726

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the KVM x86 MMU where the role.invalid flag is not explicitly cleared when creating a child shadow page from its parent. This failure to maintain the invariant that invalid pages are not on the active MMU pages list can lead to a use-after-free condition. This occurs because the kvm mmu prepare zap page() function uses list add() instead of list move() when processing an invalid shadow page. The issue was identified via a KASAN slab-use-after-free report in the kvm mmu get shadow page() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.