CVE-2026-99178
kernel: kernel: Denial of Service via race condition in KVM asynchronous page fault handling
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 28, 2026
Updated · October 29, 2026
Description
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem. When an asynchronous page fault is interrupted by a Non-Maskable Interrupt (NMI) that also encounters a page fault, the kernel improperly clears the pending fault status flags belonging to the interrupted handler. A local user can trigger this condition, causing the guest kernel to panic and resulting in a Denial of Service (DoS).
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 4.7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-364 · Signal Handler Race Condition