CVE-2026-64561

A flaw was found in KVM in the Linux kernel. This vulnerability occurs due to improper validation of memory management unit (MMU) page roots after these pages are made available. An attacker could exploit this by triggering a scenario where KVM attempts to map memory into an invalid root, causing child shadow pages to inherit an invalid state. This violates KVM's internal integrity rules, potentially leading to system instability or a denial of service within the virtualized environment.

Red Hat rates the security impact of this issue as moderate. A flaw was found in the KVM x86 memory management unit (MMU) handling in the Linux kernel, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux and the kernels in Red Hat In-Vehicle OS. KVM checked for an invalid or obsolete root before making MMU pages available for the shadow MMU, so if reclaiming shadow pages zapped an in-use root and marked it invalid, a subsequent "stale" page fault caused KVM to map memory into that invalid root. Child shadow pages created during the mapping inherited their parent's invalid role, violating KVM's invariant that invalid pages are never on the list of active MMU pages. A local attacker with low privileges could exploit this race condition to trigger system instability or a denial of service within the virtualized environment. Exploitation requires winning a race in the MMU reclaim path, which Red Hat reflects as high attack complexity in its CVSS 3.1 score of 7.0; the upstream CVE record scores the issue 8.8 with low attack complexity and changed scope. Red Hat Enterprise Linux 6 and 7 Extended Life Cycle Support kernels are not affected because the vulnerable code is not present in those versions. Fixes for the affected products are being pursued and delivered through updates.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.