Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-63806— KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 2.6.32版本及之前版本存在安全漏洞，该漏洞源于ioeventfd datamatch机制中的BUG_ON()可达性问题，可能导致在未对齐访问时触发内核崩溃。

CVSS 7.1 · High EPSS 0.15% · P5

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux d34e6b175e61821026893ec5298cc8e7558df43a< 2426c15c1395b7d5ccf1e5025ca898af7f3decb6 affected
d34e6b175e61821026893ec5298cc8e7558df43a< 4186c850789906b875a1d263377a4d37c078e317 affected
d34e6b175e61821026893ec5298cc8e7558df43a< 36ff44fb3d89960391e013fb9d91e23dbc48be47 affected
d34e6b175e61821026893ec5298cc8e7558df43a< 92fc631b69deb1c7d56aec2663003600799dcd75 affected
d34e6b175e61821026893ec5298cc8e7558df43a< bf89e3738480d33cd515b4a18900e8443d40cd2e affected
d34e6b175e61821026893ec5298cc8e7558df43a< 5da9b1a87ec7cc3489c27016313524769f12d9e0 affected
d34e6b175e61821026893ec5298cc8e7558df43a< 5c87b47374682f69686068ad0a7779365a527b1c affected
d34e6b175e61821026893ec5298cc8e7558df43a< f1edbed787ba67988ed34e0132ca128b052b6ce8 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63806

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Drop a BUG_ON() that has been reachable since it was first added, way back in 2009, and instead use get_unaligned() to perform potentially-unaligned accesses. For a given store, KVM x86's emulator tracks the entire value in the destination operand, x86_emulate_ctxt.dst. If the destination is memory, and the target splits multiple pages and/or is emulated MMIO, then KVM handles each fragment independently. E.g. on a page split starting at page offset 0xffc, KVM writes 4 bytes to the first page, then the remaining bytes to the second page, using ctxt->dst as the source for both (with appropriate offsets). If the destination splits a page *and* hits emulated MMIO on the second page, then KVM will complete the write to the first page, then emulate the MMIO access to the second page. If there is a datamatch-enabled ioeventfd at offset 0 of the second page, then KVM will process the remainder of the store as a potential ioeventfd signal. Putting it all together, if the guest emits a store that splits a page starting at page offset N, and the second page has a datamatch-enabled ioeventfd at offset 0, then KVM will check for datamatch using &dst.valptr[N] as the source. Due to dst (and thus dst.valptr) being 32-byte aligned, if N is not aligned to @len, the BUG_ON() fires. E.g. with a 16-byte store at page offset 0xffc, to an ioeventfd of len 8, all initial checks in ioeventfd_in_range() will succeed, and the BUG_ON() fires due to @val being 4-byte aligned, but not 8-byte aligned. ------------[ cut here ]------------ kernel BUG at arch/x86/kvm/../../../virt/kvm/eventfd.c:783! Oops: invalid opcode: 0000 [#1] SMP CPU: 0 UID: 1000 PID: 615 Comm: repro Not tainted 7.1.0-rc2-ff238429d1ea #365 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:ioeventfd_write+0x6c/0x70 [kvm] Call Trace: <TASK> __kvm_io_bus_write+0x85/0xb0 [kvm] kvm_io_bus_write+0x53/0x80 [kvm] vcpu_mmio_write+0x66/0xf0 [kvm] emulator_read_write_onepage+0x12a/0x540 [kvm] emulator_read_write+0x109/0x2b0 [kvm] x86_emulate_insn+0x4f8/0xfb0 [kvm] x86_emulate_instruction+0x181/0x790 [kvm] kvm_mmu_page_fault+0x313/0x630 [kvm] vmx_handle_exit+0x18a/0x590 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xc81/0x1c90 [kvm] kvm_vcpu_ioctl+0x2d5/0x970 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb7/0x890 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f19c931a9bf </TASK> Modules linked in: kvm_intel kvm irqbypass ---[ end trace 0000000000000000 ]--- In a perfect world, the fix would be to simply delete the BUG_ON(), as KVM x86 doesn't perform alignment checks on "normal" memory accesses at CPL0. Sadly, C99 ruins all the fun; while the x86 architecture plays nice, dereferencing an unaligned pointer directly is undefined behavior in C, e.g. triggers splats when running with CONFIG_UBSAN_ALIGNMENT=y.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 2.6.32版本及之前版本存在安全漏洞，该漏洞源于ioeventfd datamatch机制中的BUG_ON()可达性问题，可能导致在未对齐访问时触发内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux d34e6b175e61821026893ec5298cc8e7558df43a ~ 2426c15c1395b7d5ccf1e5025ca898af7f3decb6 -
Linux Linux 2.6.32 -

II. Public POCs for CVE-2026-63806

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63806

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-63806 (8)

Same Patch Batch · Linux · 2026-07-19 · 429 CVEs total

CVE-2026-63795 10.0 CRITICAL 9p: avoid putting oldfid in p9_client_walk() error path
CVE-2026-64033 9.8 CRITICAL RDMA/rtrs: Fix use-after-free in path file creation cleanup
CVE-2026-53399 9.8 CRITICAL nfsd: release layout stid on setlease failure
CVE-2026-53398 9.8 CRITICAL NFSD: Fix SECINFO_NO_NAME decode error cleanup
CVE-2026-64037 9.8 CRITICAL wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled
CVE-2026-63984 9.8 CRITICAL ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
CVE-2026-63979 9.8 CRITICAL net/handshake: hand off the pinned file reference to accept_doit
CVE-2026-64056 9.8 CRITICAL net: ethernet: cortina: Make RX SKB per-port
CVE-2026-63800 9.8 CRITICAL pNFS: Fix use-after-free in pnfs_update_layout()
CVE-2026-63978 9.8 CRITICAL net/handshake: Drain pending requests at net namespace exit
CVE-2026-63808 9.8 CRITICAL exfat: fix potential use-after-free in exfat_find_dir_entry()
CVE-2026-64055 9.8 CRITICAL net: ethernet: cortina: Carry over frag counter
CVE-2026-64142 9.8 CRITICAL ksmbd: close durable scavenger races against m_fp_list lookups
CVE-2026-64089 9.8 CRITICAL batman-adv: tt: fix negative last_changeset_len
CVE-2026-63922 9.8 CRITICAL ipv6: exthdrs: refresh nh after handling HAO option
CVE-2026-64091 9.8 CRITICAL batman-adv: tt: fix TOCTOU race for reported vlans
CVE-2026-64160 9.8 CRITICAL netfs: Fix potential for tearing in ->remote_i_size and ->zero_point
CVE-2026-64035 9.8 CRITICAL igc: set tx buffer type for SMD frames
CVE-2026-63888 9.8 CRITICAL scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
CVE-2026-64162 9.8 CRITICAL idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()

Showing top 20 of 429 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-63806

No comments yet

Leave a comment