In the Linux kernel, the following vulnerability has been resolved:
KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot
Reject attempts to disable KVM_MEM_GUEST_MEMFD on a memslot that was initially created with a guest_memfd binding, as KVM doesn't support toggling KVM_MEM_GUEST_MEMFD on existing memslots. KVM prevents enabling KVM_MEM_GUEST_MEMFD, but doesn't prevent clearing the flag.
Failure to reject the new memslot results in a use-after-free due to KVM not unbinding from the guest_memfd instance. Unbinding on a FLAGS_ONLY change is easy enough, and can/will be done as a hardening measure (in anticipation of KVM supporting dirty logging on guest_memfd at some point), but fixing the use-after-free would only address the immediate symptom.
================================================================== BUG: KASAN: slab-use-after-free in kvm_gmem_release+0x362/0x400 [kvm] Write of size 8 at addr ffff8881111ae908 by task repro/745
CPU: 7 UID: 1000 PID: 745 Comm: repro Not tainted 6.18.0-rc6-115d5de2eef3-next-kasan #3 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl+0x51/0x60 print_report+0xcb/0x5c0 kasan_report+0xb4/0xe0 kvm_gmem_release+0x362/0x400 [kvm] __fput+0x2fa/0x9d0 task_work_run+0x12c/0x200 do_exit+0x6ae/0x2100 do_group_exit+0xa8/0x230 __x64_sys_exit_group+0x3a/0x50 x64_sys_call+0x737/0x740 do_syscall_64+0x5b/0x900 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f581f2eac31 </TASK>
Allocated by task 745 on cpu 6 at 9.746971s: kasan_save_stack+0x20/0x40 kasan_save_track+0x13/0x50 __kasan_kmalloc+0x77/0x90 kvm_set_memory_region.part.0+0x652/0x1110 [kvm] kvm_vm_ioctl+0x14b0/0x3290 [kvm] __x64_sys_ioctl+0x129/0x1a0 do_syscall_64+0x5b/0x900 entry_SYSCALL_64_after_hwframe+0x4b/0x53
Freed by task 745 on cpu 6 at 9.747467s: kasan_save_stack+0x20/0x40 kasan_save_track+0x13/0x50 __kasan_save_free_info+0x37/0x50 __kasan_slab_free+0x3b/0x60 kfree+0xf5/0x440 kvm_set_memslot+0x3c2/0x1160 [kvm] kvm_set_memory_region.part.0+0x86a/0x1110 [kvm] kvm_vm_ioctl+0x14b0/0x3290 [kvm] __x64_sys_ioctl+0x129/0x1a0 do_syscall_64+0x5b/0x900 entry_SYSCALL_64_after_hwframe+0x4b/0x53
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Ubuntu | — | Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-realtime-6.8.1Upgrade linux-image-raspi-6.8Upgrade linux-image-gke-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-nvidiaUpgrade linux-image-6.17.0-1020-oemUpgrade linux-image-6.8.0-1037-gkeopUpgrade linux-image-6.8.0-110-lowlatencyUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-xilinx-6.8Upgrade linux-image-6.8.0-110-lowlatency-64kUpgrade linux-image-ibm-classicUpgrade linux-image-realtime-6.17Upgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-2042-raspi-realtimeUpgrade linux-image-raspi-6.17Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-generic-6.17Upgrade linux-image-6.17.0-1014-raspiUpgrade linux-image-6.8.0-1051-nvidia-lowlatency-64kUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-6.8.0-1051-nvidia-lowlatencyUpgrade linux-image-xilinxUpgrade linux-image-gkeopUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-6.8.0-1054-azureUpgrade linux-image-6.8.0-110-generic-64kUpgrade linux-image-virtual-6.8Upgrade linux-image-aws-6.8Upgrade linux-image-nvidia-tegra-6.8Upgrade linux-image-raspiUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-6.8.0-1029-xilinxUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-genericUpgrade linux-image-gcp-fipsUpgrade linux-image-oem-24.04dUpgrade linux-image-azure-6.17Upgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-1050-gkeUpgrade linux-image-aws-6.17Upgrade linux-image-oem-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-raspi-realtimeUpgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-1054-gcp-64kUpgrade linux-image-6.8.0-1022-nvidia-tegraUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.8.0-110-genericUpgrade linux-image-6.17.0-22-genericUpgrade linux-image-ibm-6.8Upgrade linux-image-fips-6.8Upgrade linux-image-gke-64k-6.8Upgrade linux-image-aws-64k-6.17Upgrade linux-image-virtual-6.17Upgrade linux-image-nvidia-64kUpgrade linux-image-oracle-6.8Upgrade linux-image-nvidia-tegraUpgrade linux-image-6.8.0-1049-oracleUpgrade linux-image-6.8.0-1052-awsUpgrade linux-image-azure-lts-24.04Upgrade linux-image-generic-lpaeUpgrade linux-image-gcp-64kUpgrade linux-image-6.8.0-1022-nvidia-tegra-rtUpgrade linux-image-6.17.0-1011-oracleUpgrade linux-image-azureUpgrade linux-image-6.17.0-1012-awsUpgrade linux-image-aws-64kUpgrade linux-image-generic-64k-6.17Upgrade linux-image-generic-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-azure-6.8Upgrade linux-image-gcpUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.17.0-1010-realtimeUpgrade linux-image-6.8.0-1054-gcpUpgrade linux-image-6.17.0-1012-gcpUpgrade linux-image-ibmUpgrade linux-image-oem-22.04cUpgrade linux-image-nvidia-6.8Upgrade linux-image-oem-22.04Upgrade linux-image-oem-24.04aUpgrade linux-image-lowlatencyUpgrade linux-image-azure-fips-6.8Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-gkeUpgrade linux-image-kvmUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-generic-6.8Upgrade linux-image-gcp-64k-6.17Upgrade linux-image-aws-fips-6.8Upgrade linux-image-awsUpgrade linux-image-6.8.0-1059-azureUpgrade linux-image-oem-22.04bUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-oracle-64k-6.17Upgrade linux-image-aws-lts-24.04Upgrade linux-image-oem-22.04dUpgrade linux-image-generic-64k-6.8Upgrade linux-image-aws-fipsUpgrade linux-image-6.8.1-1047-realtimeUpgrade linux-image-6.8.0-1052-raspiUpgrade linux-image-lowlatency-6.8Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-realtimeUpgrade linux-image-oem-24.04cUpgrade linux-image-6.8.0-1054-azure-fipsUpgrade linux-image-6.8.0-1050-gke-64kUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-gcp-6.8Upgrade linux-image-6.17.0-1011-oracle-64kUpgrade linux-image-gcp-6.17Upgrade linux-image-6.8.0-110-fipsUpgrade linux-image-6.17.0-22-generic-64kUpgrade linux-image-6.17.0-1012-aws-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-oem-6.17Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.8.0-1054-gcp-fipsUpgrade linux-image-6.8.0-1052-aws-fipsUpgrade linux-image-6.8.0-1051-nvidiaUpgrade linux-image-6.8.0-1051-nvidia-64kUpgrade linux-image-6.8.0-1051-ibmUpgrade linux-image-6.8.0-1049-oracle-64kUpgrade linux-image-6.17.0-1012-gcp-64kUpgrade linux-image-oem-24.04bUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-azure-fipsUpgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.0-1052-aws-64kUpgrade linux-image-virtualUpgrade linux-image-oracle-6.17Upgrade linux-image-oracleUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.17.0-1013-azureUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-nvidia-tegra-rt-6.8Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-fips | Apr 17, 2026 | Jan 13, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub