CVE-2026-52969: Linux KVM Integer Overflow and Guest-to-Host Escape Vulnerability

Technical summary

CVE-2026-52969 is an integer overflow and out-of-bounds access vulnerability in kvm_reset_dirty_gfn(). The kernel function validates a gfn (guest frame number) range with the check: if (!memslot || (offset + __fls(mask)) >= memslot->npages) return; where offset is u64. Since the addition is unchecked, a u64 wrap can bypass the guard. The dirty ring backing pages are MAP_SHARED at KVM_DIRTY_LOG_PAGE_OFFSET, allowing the userspace VMM to rewrite slot and offset fields between kernel writes and KVM_RESET_DIRTY_RINGS consumption. By crafting two entries with offsets 0xffffffffffffffc1 and 0, the coalescing loop computes a delta of 63, folding entry coalescing and wrapping the final offset to 0 after the addition. This zero-wrapped offset then propagates into kvm_arch_mmu_enable_log_dirty_pt_masked(), reaching gfn_to_rmap() which performs an out-of-bounds load and conditional write to arbitrary memory. The fix enforces range-checking of offset before addition to prevent wraparound.

Business impact

This vulnerability enables local privilege escalation on systems running KVM. Any user or process with access to /dev/kvm—including unprivileged containers or VM guests on shared infrastructure—can corrupt host kernel memory, potentially gaining root-level control. On multi-tenant cloud platforms, this risks lateral movement and data exfiltration across VM boundaries. The hypervisor trust boundary is broken, making it a critical concern for hosted virtualization services and on-premises data centers. Denial of service is also possible, affecting service availability.

Affected systems

All Linux kernels with KVM support are affected. This includes mainline kernels and distributions shipping KVM (Red Hat Enterprise Linux, Ubuntu, Debian, SUSE, etc.). The vulnerability is particularly dangerous on systems using shadow paging—either through legacy MMU or memory slots marked for write tracking. Kernels without KVM compiled in are not affected. Exact vulnerable version ranges are determined by when the code was introduced and when patches are applied; verify against vendor advisories for your distribution.

Exploitability

Exploitability is straightforward for local attackers. The vulnerability requires only local access to /dev/kvm, which is often available to unprivileged users on shared systems, containers, and cloud VMs. No authentication, special privileges, or user interaction is needed. The attack is reliable and repeatable once the malicious dirty ring entries are crafted. It is not a network-remote vulnerability. The CVSS score of 7.8 (HIGH) reflects the local-only requirement (AV:L) but acknowledges high impact: confidentiality, integrity, and availability are all compromised.

Remediation

Apply the upstream kernel patch that adds explicit range-checking of offset before the addition operation, ensuring offset < memslot->npages is verified independently before computing offset + __fls(mask). This prevents integer overflow. Monitor your distribution's security advisories for backported patches and apply them promptly. For systems where kernel updates are delayed, consider restricting access to /dev/kvm to trusted users only, though this is a partial mitigation and not a substitute for patching. Verify the patch has been applied by checking the kernel source or release notes against the upstream fix.

Patch guidance

Apply kernel updates from your distribution as soon as they become available. Mainline kernel users should update to a version containing the fix; the exact version number depends on the release branch. Ubuntu, Debian, Red Hat, SUSE, and other vendors will release patches through their respective channels. The fix is relatively small and focused on the bounds-check logic, so integration risk is low. Test in a non-production environment first if kernel updates require reboots. For long-term support kernels, verify the patch has been backported to your specific release. Check vendor advisories (Red Hat Security Advisories, Debian Security Tracker, etc.) for precise patch versions.

Detection guidance

Detection at the kernel level is challenging since the attack exploits shared memory that the VMM (hypervisor process) can legitimately modify. Behavioral detection might identify unusual memory corruption patterns or crashes in KVM-related code, but false positives are likely. At the host level, monitor for unexpected privilege escalations from unprivileged processes accessing /dev/kvm, or crashes in the kernel MMU/shadow paging subsystem. Intrusion detection systems looking for patterns in /dev/kvm access would require tuning to avoid noisy alerts. The most reliable detection is verifying patched kernel versions are running; use tools like 'uname -r' or distribution package managers to confirm.

Why prioritize this

This vulnerability warrants immediate patching despite being local-only. It breaks a fundamental security boundary in virtualization by allowing guest-to-host escape through the hypervisor. Any organization running KVM—whether for cloud services, container orchestration, or on-premises virtualization—is at risk. The ease of exploitation and high impact on confidentiality, integrity, and availability justify treating it as critical priority. Affected systems should be prioritized for patching ahead of higher-CVSS but less-exploitable vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: local attack vector (AV:L) and low attack complexity (AC:L), requiring privilege level L (local user access to /dev/kvm, typically available on shared systems), no user interaction, and scope unchanged. However, all three impact metrics—confidentiality, integrity, and availability—are rated high, indicating an attacker can read arbitrary memory, corrupt kernel state, and crash the system. A local privilege escalation to root is achievable. The score appropriately captures the severity despite the local-only vector; in virtualization contexts, local access is often the threat model of greatest concern.

Frequently asked questions