EUVD-2026-103971

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero...

CVE-2026-98717

The Linux kernel KVM component is vulnerable to a NULL pointer dereference within the x86/mmu shadow page table walking logic. The issue occurs when a race condition exists between memslot creation and a stage-2 page fault (EPT violation or #NPF) from L2. If the root is a "dummy" root—where the t...

CVE-2026-98717 KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero...

CVE-2026-98717

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero...

CVE-2026-98440 KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction We free the shadow S2 structures from kvmarchflushshadowall, which is a Bad Ideatm. Freeing the page tables is fair game this is what this callback is for...

EUVD-2026-103680

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction We free the shadow S2 structures from kvmarchflushshadowall, which is a Bad Ideatm. Freeing the page tables is fair game this is what this callback is for...

CVE-2026-98440 KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction We free the shadow S2 structures from kvmarchflushshadowall, which is a Bad Ideatm. Freeing the page tables is fair game this is what this callback is for...

CVE-2026-98440

A flaw in the Linux kernel's KVM subsystem on ARM64 architectures allows for a use-after-free condition. In nested virtualization setups, shadow memory management structures are prematurely freed during shadow page flushes while other system components may still reference them. A local user with ...

CVE-2026-98440

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction We free the shadow S2 structures from kvmarchflushshadowall, which is a Bad Ideatm. Freeing the page tables is fair game this is what this callback is for...

CVE-2026-98717: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero...

CVE-2026-98540: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fprobe: Terminate the fgraphdata list when the reservation is not filled fprobefgraphentry reserves shadow stack space for every fprobe with an exit handler, but only fills it for those whose entry handler returns 0...

PT-2026-116759

In the Linux kernel, the following vulnerability has been resolved: fprobe: Terminate the fgraph data list when the reservation is not filled fprobe fgraph entry reserves shadow stack space for every fprobe with an exit handler, but only fills it for those whose entry handler returns 0. fgraph...

PT-2026-116872

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix gaccess shadow fault In some circumstances, it is possible that the page of nested guest memory that is being shadowed is not present at all in the parent guest gmap. dat entry walk will not find any leaf entry and...

PT-2026-116659

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM arm64 nv component where shadow S2 structures are freed within the kvm arch flush shadow all function. Freeing the container while it may still be referenced b...

CVE-2026-98440: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction We free the shadow S2 structures from kvmarchflushshadowall, which is a Bad Ideatm. Freeing the page tables is fair game this is what this callback is for...

PT-2026-116936

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.11 contains security vulnerabilities. These vulnerabilities stem from the premature release of the shadow S2 structure in kvmarchFlushshadowall, which may lead to the reuse of containers that are still referenced after release...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.6 contains security vulnerabilities. These vulnerabilities stem from the KVM x86/mmu failing to terminate the traversal of shadow page tables immediately when the root is invalid or dummy root. When memslot creation competes with L2’s stage-2 page errors, the shadow pag...

Linux Kernel Security Vulnerabilities

The Linux kernel version 7.1 contains a security vulnerability. This vulnerability arises from fprobefgraphentry, which does not clear uninitialized reserved shadow stack spaces. As a result, fprobereturn misinterprets unused tail sections as previously called headers, potentially causing exit...

SUSE CVE-2026-110838

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes...