CVE-2026-53359: Linux KVM Shadow Paging Use-After-Free Vulnerability

Technical summary

The vulnerability is a use-after-free (CWE-416) in KVM's shadow paging implementation. The root cause is insufficient validation in kvm_mmu_get_child_sp() when reusing cached kvm_mmu_page structures. When a PDE is modified externally to split a large page (2MB) into smaller pages (4KB), the GFN (guest frame number) can match an existing page, but the role field—which tracks whether the page is direct (1) or indirect (0)—does not. The function reuses the page despite this role mismatch. Subsequent leaf SPTE installations record rmap entries under the incorrectly-configured page. During teardown, kvm_mmu_page_get_gfn() fails to locate and remove these entries because it computes the GFN incorrectly for direct=1 pages, relying on arithmetic instead of the shadowed translation table. When the memslot is freed, the rmap entries become dangling pointers. Any operation that walks the rmap (dirty logging, MMU notifier invalidation) dereferences freed memory.

Business impact

This vulnerability allows a local user with KVM guest access to cause a denial of service by crashing the host kernel, potentially affecting all VMs on that host. In multi-tenant cloud environments or shared hosting scenarios, an unprivileged guest user could destabilize the hypervisor. The HIGH CVSS score (8.8) reflects the combination of local access requirements, high confidentiality/integrity/availability impact, and scope crossing (from guest to host). While active exploitation requires KVM to be enabled and the attacker to have guest-level access, the consequences are severe.

Affected systems

All Linux kernels with KVM shadow paging support are affected. This is a core hypervisor feature present in most production Linux distributions. The vulnerability does not require specific hardware or virtualization extensions beyond KVM support. Any system running KVM-based virtual machines and allowing local user access to guest creation or guest interaction is at risk.

Exploitability

Exploitation requires local user access to the system with the ability to interact with KVM (typically via /dev/kvm). The attacker must run code inside a guest VM with permissions to trigger memory-mapped I/O operations or coordinate with the host to modify PDE structures. No network access or privilege escalation outside KVM is needed to trigger the crash. However, reliable exploitation of the use-after-free for code execution (rather than denial of service) is complex and depends on controlling memory layout post-free. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Remediation

The fix involves adding role comparison to kvm_mmu_get_child_sp() so that pages are only reused if both the GFN and the role match. Alternatively, the lookup and caching logic can be enhanced to invalidate or prevent reuse when structural mismatches occur. Patching is the only mitigation; there is no configuration workaround. Organizations must update the Linux kernel to a patched version. Verify against your distribution's security advisory for the specific kernel version containing the fix.

Patch guidance

Apply the latest kernel security updates from your Linux distribution immediately. Consult your vendor's advisory for the specific patched kernel version. For distributions using long-term support kernels, check both the stable and LTS kernel repositories. If you cannot patch immediately, disable KVM or restrict guest creation to trusted users only. Test patches in a non-production environment first to ensure compatibility with your workloads.

Detection guidance

Monitor for kernel panic messages or oops dumps mentioning shadow paging, kvm_mmu_page, or rmap operations. Check system logs for unusual KVM-related errors. Kernel Address Sanitizer (KASAN) or similar runtime checks may detect the use-after-free if enabled. Host-based intrusion detection systems should alert on unexpected kernel crashes correlated with guest VM activity. Memory forensics post-crash may reveal corruption patterns in the kvm_mmu_page cache.

Why prioritize this

This vulnerability merits immediate attention because: (1) it allows local denial of service of the entire hypervisor, affecting all VMs; (2) it requires no special privileges beyond KVM access, which is commonly available in cloud and shared hosting; (3) the CVSS score of 8.8 reflects high impact; and (4) shadow paging is widely used. Organizations should prioritize patching systems that host multiple VMs or untrusted guests.

Risk score, explained

CVSS 8.8 (HIGH) is justified by the combination of Local access vector (AV:L), Low attack complexity (AC:L), Low privilege requirement (PR:L), No user interaction (UI:N), Changed scope (S:C—guest to host), and High impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The scope change from guest to host context is critical; what appears as a guest-level crash actually compromises the host. The HIGH severity reflects the severity of the consequences, not the ease of exploitation.

Frequently asked questions