Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-80726— KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于KVM x86/mmu在创建子shadow page时未明确清除role.invalid，导致无效页面仍位于活动MMU页面列表中，引发释放后重用。

CVSS 9.3 · Critical EPSS 0.18% · P8

Affected Version Matrix 14

VendorProduct Version RangeStatus
Linux Linux a770f6f28b1a9287189f3dc8333eb694d9a2f0ab< 9b7984692c18b22d6d61af3f53887fca7fddb0f1 affected
a770f6f28b1a9287189f3dc8333eb694d9a2f0ab< f33ecb89d352348ed5e625f6747ac51ede254e1b affected
a770f6f28b1a9287189f3dc8333eb694d9a2f0ab< 0af4711862c5b818204d40b21f0859ad51c230e9 affected
a770f6f28b1a9287189f3dc8333eb694d9a2f0ab< 66bc868a33cf1de43f22a94acd8857e0fe33393f affected
a770f6f28b1a9287189f3dc8333eb694d9a2f0ab< 9f7760a2e962cbda0d096a27d394d14ad4d22928 affected
a770f6f28b1a9287189f3dc8333eb694d9a2f0ab< 5ec42d57655c690234c14aece6dd3f209778c1d8 affected
2.6.30 affected
< 2.6.30 unaffected
… +6 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80726

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page Explicitly clear role.invalid when deriving a child shadow page's role from its parent to harden against bugs elsewhere in KVM, as violating KVM's invariant that invalid pages are NOT on the list of active MMU pages leads to use-after-free due to __kvm_mmu_prepare_zap_page() using list_add() instead of list_move() when processing an invalid shadow page, i.e. makes a bad situation far worse. Yell loudly if the parent is invalid, as it means KVM has missed a validity check, i.e. KVM is attempting to map memory using an invalid/obsolete root, but continue on as the child is otherwise still a valid shadow page. ================================================================== BUG: KASAN: slab-use-after-free in __kvm_mmu_get_shadow_page+0x1817/0x1860 [kvm] Write of size 8 at addr ff11000153dd1368 by task repro/853 CPU: 1 UID: 1000 PID: 853 Comm: repro Not tainted 7.2.0-rc2-3aec122bdcaf-next-vm #5 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl+0x4b/0x70 print_report+0x153/0x49c kasan_report+0xbc/0xf0 __kvm_mmu_get_shadow_page+0x1817/0x1860 [kvm] mmu_alloc_root+0x141/0x320 [kvm] kvm_mmu_load+0x612/0x20f0 [kvm] kvm_arch_vcpu_ioctl_run+0x3dd5/0x6150 [kvm] kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm] __x64_sys_ioctl+0x131/0x1b0 do_syscall_64+0x67/0x5f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> Allocated by task 853: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x5f/0x70 kmem_cache_alloc_noprof+0xfe/0x2e0 __kvm_mmu_topup_memory_cache+0x135/0x530 [kvm] paging64_page_fault+0x318/0x1e30 [kvm] kvm_mmu_do_page_fault+0x21d/0x630 [kvm] kvm_mmu_page_fault+0x18c/0x17b0 [kvm] kvm_arch_vcpu_ioctl_run+0x1f35/0x6150 [kvm] kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm] __x64_sys_ioctl+0x131/0x1b0 do_syscall_64+0x67/0x5f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Freed by task 853: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x43/0x70 kmem_cache_free+0xe2/0x400 kvm_mmu_commit_zap_page.part.0+0x1e2/0x310 [kvm] kvm_mmu_free_roots+0x283/0x560 [kvm] kvm_arch_vcpu_ioctl_run+0x33c8/0x6150 [kvm] kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm] __x64_sys_ioctl+0x131/0x1b0 do_syscall_64+0x67/0x5f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于KVM x86/mmu在创建子shadow page时未明确清除role.invalid，导致无效页面仍位于活动MMU页面列表中，引发释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux a770f6f28b1a9287189f3dc8333eb694d9a2f0ab ~ 9b7984692c18b22d6d61af3f53887fca7fddb0f1 -
Linux Linux 2.6.30 -

II. Public POCs for CVE-2026-80726

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80726

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80726 (6)

Same Patch Batch · Linux · 2026-09-03 · 32 CVEs total

CVE-2026-80734 8.8 HIGH btrfs: initialize inode mapping flags for cached inodes
CVE-2026-80753 8.4 HIGH ovpn: run deferred work on a module-owned workqueue
CVE-2026-80752 8.4 HIGH Input: psxpad-spi - set driver data before use
CVE-2026-80750 8.4 HIGH pmdomain: mediatek: fix remaining %pOF after of_node_put()
CVE-2026-80745 8.4 HIGH regulator: fp9931: Fix VPOS/VNEG voltage selector table
CVE-2026-80747 8.0 HIGH drm/amdkfd: Add bounds check for CRAT subtype length
CVE-2026-80736 7.8 HIGH thunderbolt: Fix bandwidth group reservation indexing
CVE-2026-80754 7.8 HIGH Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
CVE-2026-80751 7.8 HIGH pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev()
CVE-2026-80748 7.8 HIGH mmc: loongson2: Fix sg iteration in data reorder functions
CVE-2026-80737 7.8 HIGH serial: amba-pl011: synchronize DMA teardown
CVE-2026-80732 7.8 HIGH ata: pata_sl82c105: fix bridge revision use-after-free
CVE-2026-80731 7.8 HIGH net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
CVE-2026-80735 7.3 HIGH ovpn: ensure socket is owned by ovpn before deref sk_user_data
CVE-2026-80738 7.3 HIGH bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
CVE-2026-80741 7.1 HIGH drm/log: Fix out-of-bounds read on empty message length
CVE-2026-80749 7.1 HIGH drm/connector/hdmi: Fix out of bounds memory read
CVE-2026-80730 ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
CVE-2026-80733 net: remove WARN_ON_ONCE() from sk_mc_loop()
CVE-2026-80729 mm/huge_memory: initialise workingset state before folio split

Showing top 20 of 32 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-80726

No comments yet

Leave a comment