CVE-2026-68166

A flaw was found in the Linux kernel's userfaultfd mechanism. A local attacker with userfaultfd access could register on shadow stack Virtual Memory Areas (VMAs). By discarding a page and injecting a page with chosen return addresses, an attacker could achieve arbitrary code execution. This vulnerability arises from the improper handling of special VMAs, including shadow stacks, allowing for manipulation of memory regions.

This vulnerability is rated as Important severity because local unprivileged users capable of invoking the userfaultfd subsystem can compromise shadow stack memory protections to alter execution flow and achieve privilege escalation. Exploitation requires hardware supporting shadow stacks alongside access to userfaultfd, limiting the attack surface to local users on modern architectures. Earlier platform releases, such as Red Hat Enterprise Linux 8, do not include the vulnerable shadow stack implementation and remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.