CVE-2026-68428

A flaw was found in the KVM (Kernel-based Virtual Machine) component of the Linux kernel. A local attacker with privileges to load and unload kernel modules could exploit a use-after-free vulnerability. This occurs when a vendor module is unloaded while the KVM module remains loaded, and a subsequent module load fails, leading to an attempt to use a freed memory cache. This could result in a system crash (denial of service) or potentially allow for privilege escalation.

This issue affects KVM on x86 when vendor modules (Intel/AMD) are reloaded. mmu_destroy_caches() leaves stale cache pointers that UAF on reload. Requires ability to load/unload KVM vendor modules.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.