CVE-2026-23401

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) component. A local attacker with privileges on the host system could exploit a vulnerability in how KVM handles shadow page table entries (SPTEs) during memory-mapped I/O (MMIO) operations. By manipulating guest page table entries (gPTEs) from host userspace, an attacker could cause KVM to install an MMIO SPTE without properly removing an existing shadow-present SPTE. This improper handling could lead to a kernel warning, resulting in a denial of service or potentially allowing for privilege escalation or information disclosure.

This is an Important impact vulnerability. A flaw in the KVM's x86/mmu component in the Linux kernel could allow a privileged guest user to trigger a host denial of service. This issue occurs when host userspace modifies a shadowed gPTE to switch from a memslot to emulated MMIO, leading to a missing SPTE zap. Red Hat Enterprise Linux 8, 9, and 10, and Red Hat In-Vehicle OS are affected. Red Hat Enterprise Linux 6 and 7 are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.