CVE-2026-53359

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) x86 shadow paging mechanism. This vulnerability occurs when a host page directory entry (PDE) mapping is changed from within the guest, leading to an unexpected role mismatch in shadow paging. This mismatch can cause a use-after-free condition, where the system attempts to access memory that has already been released. Such a condition can lead to system instability, denial of service, potentially the execution of arbitrary code or guest-to-host escape.

This is an Important flaw in the KVM x86 shadow paging mechanism where an attacker with privileged access inside the guest VM could trigger a use-after-free condition by manipulating page directory entries on the host. This could lead to system instability, denial of service, or potentially arbitrary code execution on the host.

In Red Hat Enterprise Linux 7, nested virtualization for KVM is a Technology Preview feature and the nested parameter defaults to 0 (disabled) for both kvm_intel and kvm_amd.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This vulnerability can be mitigated by disabling nested virtualization. Create a file in /etc/modprobe.d/ with a descriptive name, such as cve-2026-53359-mitigation.conf. In that file, disable nested virtualization for the kvm_intel and kvm_amd kernel modules:

options kvm-intel nested=0
options kvm-amd nested=0

Use lsmod to determine if either module is already loaded. If so, remove loaded modules with modprobe -r. To validate that nested virtualization is disabled, read the files /sys/module/kvm_intel/parameters/nested and /sys/module/kvm_amd/parameters/nested. If these modules are loaded, those files should read N to indicate that the feature is disabled.

In OpenShift 4, a MachineConfig can be utilized to create a modprobe configuration allowing control of the module on applicable nodes. See the following article for an example.

https://access.redhat.com/solutions/6979679

Red Hat OpenStack Platform 16.2 and 17.1, and Red Hat OpenStack Services on OpenShift 18.0, can be affected when their nodes run a vulnerable RHEL or OpenShift kernel. Follow the knowledge base article to apply the mitigation.

https://access.redhat.com/solutions/7145295