CVE-2026-63807
kernel: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · July 19, 2026
Updated · July 31, 2026
Description
A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) x86 memory management unit (MMU). A malicious guest operating system could create a hugepage mapping that extends beyond the boundaries of its allocated memory slot. This improper handling of memory boundaries by KVM can lead to an out-of-bounds access, resulting in a host page fault and a denial of service (DoS) for the host system.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-125 · Out-of-bounds Read