CVE-2026-90040

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) component, specifically affecting Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) virtual machines. When a guest memory page backing a Virtual Machine Save Area (VMSA) is invalidated, KVM may fail to properly free the page. This can lead to the virtual machine's firmware rejecting memory reclamation, resulting in a page fault and potential denial of service for the affected virtual machine.

KVM SEV-SNP can keep a stale VMSA physical address in the vCPU control state when the guest_memfd page backing the guest provided VMSA is invalidated, for example by PUNCH_HOLE or memslot delete or move. If the vCPU keeps running with that VMSA page in use, firmware can reject RMPUPDATE reclaim with FAIL_INUSE and the page may later cause an RMP violation and host kernel crash. For the CVSS the PR:L is used because a local user or service with KVM VM control and access to the SNP guest_memfd can trigger the invalidation. The issue is not directly network reachable and requires an SEV-SNP KVM environment. Impact is at least local denial of service via host crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.