CVE-2026-63807 - Vulnerability Details

- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level

When recovering hugepages in the shadow MMU, verify that the base gfn of
the shadow page is actually contained within the target memslot, *before*
querying the max mapping level given the shadow page's gfn. Failure to
pre-check the validity of the gfn can lead to an out-of-bounds access to
the slot's lpage_info (which typically manifests as a host #PF because the
lpage_info is vmalloc'd) if the guest creates a hugepage mapping (in its
PTEs) that extends "below" the bounds of a memslot.

When faulting in memory for a guest, and the size of the guest mapping is
greater than KVM's (current) max mapping, then KVM will create a "direct"
shadow page (direct in that there are no gPTEs to shadow, and so the target
gfn is a direct calculation given the base gfn of the shadow page). The
hugepage recovery flow looks for such direct shadow pages, as forcing 4KiB
mappings when dirty logging generates the guest > host mapping size case.
When the 4KiB restriction is lifted, then KVM can replace the shadow page
with a hugepage.

But if KVM originally used a smaller mapping than the guest because the
range of memory covered by the guest hugepage exceeds the bounds of a
memslot, then KVM will link a direct shadow page with a gfn that is outside
the bounds of the memslot being used to fault in memory. The rmap entry
added for the leaf mapping is correct and within bounds, but the gfn of the
leaf SPTE's parent shadow page will be out of bounds.

BUG: unable to handle page fault for address: ffffc90000806ffc
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 100000067 P4D 100000067 PUD 1002a7067 PMD 10612f067 PTE 0
Oops: Oops: 0000 [#1] SMP
CPU: 13 UID: 1000 PID: 757 Comm: mmu_stress_test Not tainted 7.1.0-rc1-48ce1e26eace-x86_pir_to_irr_comments-vm #341 PREEMPT
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
RIP: 0010:kvm_mmu_max_mapping_level+0x79/0x2b0 [kvm]
Call Trace:
<TASK>
kvm_mmu_recover_huge_pages+0x21b/0x320 [kvm]
kvm_set_memslot+0x1ee/0x590 [kvm]
kvm_set_memory_region.part.0+0x3a1/0x4d0 [kvm]
kvm_vm_ioctl+0x9bf/0x15d0 [kvm]
__x64_sys_ioctl+0x8a/0xd0
do_syscall_64+0xb7/0xbb0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
RIP: 0033:0x7f21c0f1a9bf
</TASK>

Don't bother pre-checking the bounds of the potential hugepage, i.e. don't
check that e.g. sp->gfn + KVM_PAGES_PER_HPAGE(sp->role.level + 1) is also
within the memslot, as the checks performed by kvm_mmu_max_mapping_level()
are a superset of the basic bounds checks. I.e. pre-checking the full
range would be a dubious micro-optimization.

Published: 2026-07-19

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s KVM component contains a missing bounds check when recovering hugepages. If a guest VM creates a hugepage that extends beyond the limits of a memory slot, the kernel may read lpage_info data outside the slot’s bounds. This out‑of‑bounds access produces a page fault that crashes the host kernel, interrupting all services running on the host.

Affected Systems

The vulnerability affects any Linux system running the KVM hypervisor with an unpatched kernel. All distributions using the kernel at this code level are impacted, regardless of kernel version, as the patch is applied directly in the KVM component. Guests that use hugepages in KVM are the vehicles for the trigger.

Risk and Exploitability

The CVSS score of 8.8 reflects the severity of a kernel crash, while the EPSS score of < 1% indicates that exploitation is currently very unlikely. The bug is not listed in CISA’s KEV catalog. The exploit requires a guest VM that attempts to map a hugepage whose address range falls below a memory slot boundary, leading the host to perform an out‑of‑bounds read and crash. No remote code execution or privilege escalation is documented; the impact is limited to denial of service on the host.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9eba50f8d7fcb61774f160890f98239fa3ab68a6`	affected	< 7b52008023b7facf40fba3ebe92449bda8ea53b9
`9eba50f8d7fcb61774f160890f98239fa3ab68a6`	affected	< 5cab1c989f938f5e1b9a0de66486f1fc2c28479b
`9eba50f8d7fcb61774f160890f98239fa3ab68a6`	affected	< 48b91ed7e22bb82571c34f8b80b6ecdc90a6fab8
`9eba50f8d7fcb61774f160890f98239fa3ab68a6`	affected	< c5c29b3c268332afe67d598a034c58344540ed92
`9eba50f8d7fcb61774f160890f98239fa3ab68a6`	affected	< 18587f9831612e24cd8f24be1ec15478feff7abc
`9eba50f8d7fcb61774f160890f98239fa3ab68a6`	affected	< b2ae3245ea44dccaa9af676b6747476951883318
`9eba50f8d7fcb61774f160890f98239fa3ab68a6`	affected	< ef057cbf825e03b63f6edf5980f96abf3c53089d

Linux

affected

Version	Status	Constraints
`5.12`	affected	—
`0`	unaffected	< 5.12
`5.15.211`	unaffected	≤ 5.15.*
`6.1.177`	unaffected	≤ 6.1.*
`6.6.144`	unaffected	≤ 6.6.*
`6.12.95`	unaffected	≤ 6.12.*
`6.18.38`	unaffected	≤ 6.18.*
`7.1.3`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[9eba50f8d7fcb61774f160890f98239fa3ab68a6,7b52008023b7facf40fba3ebe92449bda8ea53b9)`	affected	code_commit	—
`[9eba50f8d7fcb61774f160890f98239fa3ab68a6,5cab1c989f938f5e1b9a0de66486f1fc2c28479b)`	affected	code_commit	—
`[9eba50f8d7fcb61774f160890f98239fa3ab68a6,48b91ed7e22bb82571c34f8b80b6ecdc90a6fab8)`	affected	code_commit	—
`[9eba50f8d7fcb61774f160890f98239fa3ab68a6,c5c29b3c268332afe67d598a034c58344540ed92)`	affected	code_commit	—
`[9eba50f8d7fcb61774f160890f98239fa3ab68a6,18587f9831612e24cd8f24be1ec15478feff7abc)`	affected	code_commit	—
`[9eba50f8d7fcb61774f160890f98239fa3ab68a6,b2ae3245ea44dccaa9af676b6747476951883318)`	affected	code_commit	—
`[9eba50f8d7fcb61774f160890f98239fa3ab68a6,ef057cbf825e03b6f6edf5980f96abf3c53089d)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.12`	affected	generic	—
`[0,5.12)`	unaffected	generic	—
`[5.15.211,5.16.0)`	unaffected	semver	—
`[6.1.177,6.2.0)`	unaffected	semver	—
`[6.6.144,6.7.0)`	unaffected	semver	—
`[6.12.95,6.13.0)`	unaffected	semver	—
`[6.18.38,6.19.0)`	unaffected	semver	—
`[7.1.3,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that includes the commit fixing the bounds check in hugepage recovery for KVM.
Review KVM configuration to ensure guest memory allocations and hugepage mappings stay within the boundaries of their designated memory slots.
If an immediate kernel update is not possible, limit or disable hugepage usage in guest VMs to avoid the boundary condition that can trigger the crash.

Generated by OpenCVE AI on October 23, 2026 at 00:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4700-1	linux-6.1 security update
Ubuntu USN	USN-8726-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8727-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8760-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-2	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8781-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8726-3	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8800-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8760-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-4	Linux kernel vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8917-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8918-1	Linux kernel (Azure) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00173.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/18587f9831612e24cd8f24be1ec15478feff7abc
https://git.kernel.org/stable/c/48b91ed7e22bb82571c34f8b80b6ecdc90a6fab8
https://git.kernel.org/stable/c/5cab1c989f938f5e1b9a0de66486f1fc2c28479b
https://git.kernel.org/stable/c/7b52008023b7facf40fba3ebe92449bda8ea53b9
https://git.kernel.org/stable/c/b2ae3245ea44dccaa9af676b6747476951883318
https://git.kernel.org/stable/c/c5c29b3c268332afe67d598a034c58344540ed92
https://git.kernel.org/stable/c/ef057cbf825e03b63f6edf5980f96abf3c53089d
https://lore.kernel.org/linux-cve-announce/2026071902-CVE-2026-63807-1018@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63807
https://www.cve.org/CVERecord?id=CVE-2026-63807

History

Mon, 19 Oct 2026 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026071902-CVE-2026-63807-1018@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63807 https://www.cve.org/CVERecord?id=CVE-2026-63807
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level When recovering hugepages in the shadow MMU, verify that the base gfn of the shadow page is actually contained within the target memslot, before querying the max mapping level given the shadow page's gfn. Failure to pre-check the validity of the gfn can lead to an out-of-bounds access to the slot's lpage_info (which typically manifests as a host #PF because the lpage_info is vmalloc'd) if the guest creates a hugepage mapping (in its PTEs) that extends "below" the bounds of a memslot. When faulting in memory for a guest, and the size of the guest mapping is greater than KVM's (current) max mapping, then KVM will create a "direct" shadow page (direct in that there are no gPTEs to shadow, and so the target gfn is a direct calculation given the base gfn of the shadow page). The hugepage recovery flow looks for such direct shadow pages, as forcing 4KiB mappings when dirty logging generates the guest > host mapping size case. When the 4KiB restriction is lifted, then KVM can replace the shadow page with a hugepage. But if KVM originally used a smaller mapping than the guest because the range of memory covered by the guest hugepage exceeds the bounds of a memslot, then KVM will link a direct shadow page with a gfn that is outside the bounds of the memslot being used to fault in memory. The rmap entry added for the leaf mapping is correct and within bounds, but the gfn of the leaf SPTE's parent shadow page will be out of bounds. BUG: unable to handle page fault for address: ffffc90000806ffc #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 100000067 P4D 100000067 PUD 1002a7067 PMD 10612f067 PTE 0 Oops: Oops: 0000 [#1] SMP CPU: 13 UID: 1000 PID: 757 Comm: mmu_stress_test Not tainted 7.1.0-rc1-48ce1e26eace-x86_pir_to_irr_comments-vm #341 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:kvm_mmu_max_mapping_level+0x79/0x2b0 [kvm] Call Trace: <TASK> kvm_mmu_recover_huge_pages+0x21b/0x320 [kvm] kvm_set_memslot+0x1ee/0x590 [kvm] kvm_set_memory_region.part.0+0x3a1/0x4d0 [kvm] kvm_vm_ioctl+0x9bf/0x15d0 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb7/0xbb0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f21c0f1a9bf </TASK> Don't bother pre-checking the bounds of the potential hugepage, i.e. don't check that e.g. sp->gfn + KVM_PAGES_PER_HPAGE(sp->role.level + 1) is also within the memslot, as the checks performed by kvm_mmu_max_mapping_level() are a superset of the basic bounds checks. I.e. pre-checking the full range would be a dubious micro-optimization.
Title		KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/18587f9831612e24cd8f24be1ec15478feff7abc https://git.kernel.org/stable/c/48b91ed7e22bb82571c34f8b80b6ecdc90a6fab8 https://git.kernel.org/stable/c/5cab1c989f938f5e1b9a0de66486f1fc2c28479b https://git.kernel.org/stable/c/7b52008023b7facf40fba3ebe92449bda8ea53b9 https://git.kernel.org/stable/c/b2ae3245ea44dccaa9af676b6747476951883318 https://git.kernel.org/stable/c/c5c29b3c268332afe67d598a034c58344540ed92 https://git.kernel.org/stable/c/ef057cbf825e03b63f6edf5980f96abf3c53089d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T12:02:10.759Z

Updated: 2026-10-19T20:07:48.277Z

Reserved: 2026-07-19T07:54:57.013Z

Link: CVE-2026-63807

Vulnrichment

No data.

NVD

Status : Modified

Published: 2026-07-19T12:16:53.470

Modified: 2026-10-19T20:19:21.260

Link: CVE-2026-63807

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63807 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-23T00:30:08Z

Weaknesses

CWE-125
Out-of-bounds Read
CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object