CVE-2026-46113

Technical summary

CVE-2026-46113 is a use-after-free (CWE-416) vulnerability in KVM's shadow MMU implementation. The root cause is an assumption that guest frame numbers (GFNs) for shadow pages remain constant based on sp->gfn plus SPTE index offsets. When guest page tables are modified between VM entries—specifically when a 2MB PDE mapping changes—KVM may create SPTEs with GFNs outside the expected [sp->gfn, sp->gfn + 511] range. When the original memslot is deleted and rmap_remove() attempts cleanup, it fails to locate rmap entries recorded under the new GFN, leaving stale pointers. Subsequent rmap walks during operations like dirty logging or MMU notifier invalidations dereference the freed kvm_mmu_page structure. The fix involves checking for target GFN mismatches during SPTE installation and proactively zapping existing SPTEs when a mismatch is detected, ensuring rmap entries are recorded in the correct location.

Business impact

For virtualization infrastructure operators, this vulnerability poses a significant availability and integrity risk. A guest user can trigger a kernel use-after-free that crashes the host or potentially executes code in the hypervisor context, compromising isolation between guest VMs and the host. Cloud providers, hosting platforms, and enterprises running multi-tenant KVM deployments must prioritize patching to prevent guest-to-host escape scenarios and ensure host stability. The attack requires only local guest access, making it exploitable by unprivileged tenant processes.

Affected systems

The Linux kernel is affected across multiple distributions and versions that include KVM with shadow paging. Shadow paging is commonly enabled for older hardware or when EPT/NPT (hardware-assisted page tables) are unavailable or explicitly disabled. Any Linux system running a vulnerable kernel version with KVM shadow MMU in use is at risk. Verify your kernel version against the vendor advisory and check if shadow paging is active in your environment.

Exploitability

Exploitability is moderate to high. The vulnerability requires local access to a guest VM, meaning an unprivileged guest user or process can trigger the race condition by inducing guest page table modifications between VM entries. No special privileges within the guest are needed. However, reliable exploitation may require timing control to force the specific sequence of page table modifications and memory accesses. The attack surface is broad because many KVM deployments still use shadow paging, particularly on systems without hardware MMU support.

Remediation

Apply the upstream Linux kernel patch that adds GFN mismatch detection in the shadow MMU's SPTE installation path. The patch checks whether the target GFN for a new leaf SPTE falls outside the expected range for the existing shadow page; if so, it zaps the stale SPTE before installing the new one. Consult your Linux distribution's kernel advisories and security update channels for patched kernel versions. Test patches in non-production environments first, particularly if shadow paging is critical to your workload.

Patch guidance

Monitor your distribution's kernel security advisories for published CVE-2026-46113 patches. Verify patch availability through your vendor's advisory pages (Red Hat, Canonical, SUSE, etc.). Once available, plan kernel updates on a schedule that balances security urgency with system downtime tolerance; KVM updates typically require VM migration or restart. For large deployments, stage updates to non-critical systems first to validate compatibility. Confirm that patched kernels are compiled with KVM shadow MMU support enabled and that your VMs are using shadow paging if applicable.

Detection guidance

Monitor for kernel page faults and use-after-free errors in syslog and kernel error logs that coincide with VM memory operations or guest page table modifications. Systems may exhibit symptoms including unexpected VM crashes, kernel panics mentioning kvm_mmu_page or rmap structures, or general instability under concurrent guest workloads. Kernel address sanitizer (KASAN) or similar debugging tools can help detect use-after-free if enabled in testing environments. Host-based intrusion detection may flag unusual guest-to-host memory access patterns, though this is difficult to detect reliably in production without custom instrumentation.

Why prioritize this

This vulnerability merits urgent prioritization due to its high CVSS score (8.8), local attack vector, and potential for guest-to-host privilege escalation. The use-after-free nature makes it a critical stability and security concern for virtualization platforms. Although the attack requires local guest access, the broad deployment of KVM and shadow paging in cloud and enterprise environments means many systems are likely vulnerable. Patching should be scheduled as soon as vendor patches are available.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a local attack vector (AV:L) with low attack complexity (AC:L), no special privileges required (PR:L), and no user interaction needed (UI:N). The impact is severe: confidentiality, integrity, and availability are all compromised (C:H/I:H/A:H) with a scope change (S:C) allowing escape from the guest VM context. The score appropriately captures the threat of host compromise through a guest-initiated use-after-free.

Frequently asked questions