CVE-2026-99082— KVM x86 内存管理漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 Linux 内核中，以下漏洞已得到修复： KVM：x86：针对每 vCPU 的 MMIO 缓存使用活动（active）的内存槽（memslots） KVM 通过为每 vCPU 的 MMIO 缓存标记内存槽的“代次”（generation），使得当内存槽更新时，能够无效化缓存中的 MMIO 信息。然而，在填充（fill）和验证（validation）路径中，代码均调用了 ，该函数无条件地选择地址空间 0，即使此时 vCPU 正处于系统管理模式（SMM）并应使用地址空间 1。 提交 56f17dd3fbc4（"kv
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-99082 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
KVM: x86: Use active memslots for the per-vCPU MMIO cache
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Use active memslots for the per-vCPU MMIO cache
KVM tags the per-vCPU MMIO cache with a memslot generation so that a
memslot update invalidates cached MMIO information. Both the fill and
validation paths use kvm_memslots(), which unconditionally selects address
space 0, even when the vCPU is running in SMM and using address space 1.
Commit 56f17dd3fbc4 ("kvm: x86: fix stale mmio cache bug") added the
memslot generation to the cache key so that a memslot update could not
leave a stale entry valid. When commit 699023e23965 ("KVM: x86: add SMM
to the MMU role, support SMRAM address space") added the SMM address space,
these helpers were not converted to use the active memslots.
Consequently, an update to the SMM memslots can leave an entry from the old
SMM address space apparently valid after the vCPU returns to the normal
address space. A guest can then cause an access to valid RAM at the same
GFN to be returned to userspace as KVM_EXIT_MMIO.
Completing that exit through the VMM's RAM address space writes the backing
page without going through KVM's write-tracking path. If the page backs a
nested EPT table, KVM can continue using shadow translations derived from
the old contents. The WARN_ON_ONCE() in kvm_mmu_write_protect_fault()
catches this invalid cache and memslot combination.
Use the vCPU's active memslots when caching and validating the entry.
Memslot generations are unique across address spaces, so the generation
also distinguishes the normal and SMM views. This matches the MMIO SPTE
cache, which already uses kvm_vcpu_memslots().
On an unpatched current-mainline kernel, a regression test that fills the
cache in SMM and updates only the SMM memslots fails the intended RAM write
and triggers the kvm_mmu_write_protect_fault() warning. With this change,
the same test completes the RAM write without a warning. The x86/smm_test,
set_memory_region_test, and memslot_modification_stress_test selftests also
pass.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-99082 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-99082 的情报信息
请登录查看更多情报信息。
CVE-2026-99082 其他参考 (5)
同批安全公告 · Linux · 2026-10-23 · 共 218 条
| CVE-2026-98937 | Linux 内核 perf 远程代码执行漏洞 | |
| CVE-2026-98950 | Linux kernel flow_dissector 整数截断漏洞 | |
| CVE-2026-98949 | Imagination DRM 驱动 remap() 函数引用及 vm_bo 处理漏洞 | |
| CVE-2026-98948 | Mellanox mlxsw 端口范围寄存器泄漏漏洞 | |
| CVE-2026-98947 | vsock 内存泄漏漏洞 | |
| CVE-2026-98946 | V3D 驱动运行时挂起中断禁用漏洞 | |
| CVE-2026-98945 | Steam HID 驱动解绑顺序漏洞 | |
| CVE-2026-98944 | Steam HID 注册重构漏洞 | |
| CVE-2026-98943 | Steam HID 驱动锁清理 | |
| CVE-2026-98942 | Linux 内核 sched_ext 远程代码执行漏洞 | |
| CVE-2026-98941 | ext4 加密 inode 大页启用逻辑漏洞 | |
| CVE-2026-98940 | Linux 内核 ASoC 组件越界读取漏洞 | |
| CVE-2026-98939 | Linux x86/mm 内存管理逻辑缺陷 | |
| CVE-2026-98938 | Rust IRQ 请求机制参数传递漏洞 | |
| CVE-2026-98926 | AMD Display 驱动 DPMS 电源管理漏洞 | |
| CVE-2026-98929 | macsec 在注册前初始化 SecY 的竞态条件漏洞 | |
| CVE-2026-98928 | KVM arm64 信息泄露漏洞 | |
| CVE-2026-98927 | KVM arm64 嵌套 MMU 数组生命周期漏洞 | |
| CVE-2026-98930 | KVM s390 中断注入漏洞 | |
| CVE-2026-98925 | Linux bpf sockmap 序列号重复计数漏洞 |
显示前 20 条，共 218 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2026-99082
暂无评论