CVE-2026-68428 - Vulnerability Details

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86/mmu: Fix use-after-free on vendor module reload

mmu_destroy_caches() destroys pte_list_desc_cache and
mmu_page_header_cache, but leaves both pointers unchanged. The pointers
live in kvm.ko, and therefore survive when a vendor module is unloaded
while kvm.ko remains loaded.

If creation of pte_list_desc_cache fails during a subsequent vendor
module load, its assignment sets pte_list_desc_cache to NULL and the
error path calls mmu_destroy_caches(). mmu_page_header_cache still
points to the cache destroyed during the preceding vendor module
unload. Passing that stale pointer to kmem_cache_destroy() causes a
slab use-after-free.

Reproduce the issue on a v7.1.3 kernel with CONFIG_KASAN=y,
CONFIG_KASAN_GENERIC=y, CONFIG_KVM=m, and CONFIG_KVM_INTEL=m. A
one-shot test hook forces pte_list_desc_cache to NULL on the second
invocation of kvm_mmu_vendor_module_init():

1. Load kvm.ko and kvm-intel.ko, creating both caches.
2. Unload only kvm_intel, leaving kvm.ko loaded.
3. Reload kvm_intel and force initialization through the -ENOMEM path.

KASAN reports:

BUG: KASAN: slab-use-after-free in
kvm_mmu_vendor_module_init+0x5b/0x170 [kvm]
...
kmem_cache_destroy+0x21/0x1d0
kvm_mmu_vendor_module_init+0x5b/0x170 [kvm]
...
Allocated by task 16817:
__kmem_cache_create_args+0x12c/0x3b0
__kmem_cache_create.constprop.0+0xb6/0xf0 [kvm]
kvm_mmu_vendor_module_init+0x13b/0x170 [kvm]
...
Freed by task 16820:
kmem_cache_destroy+0x117/0x1d0
kvm_mmu_vendor_module_exit+0x21/0x30 [kvm]

Clear both pointers immediately after destroying their caches so that
the stored state reflects the caches' lifetime and repeated cleanup is
safe.

With the fix applied, the same injected vendor module reload fails with
-ENOMEM as expected and produces no KASAN report.

Published: 2026-08-10

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The flaw occurs when the KVM module reloads: stale pointers to memory caches survive past an unload of a vendor module and are later passed to a cache destroy function after a failed reload. This triggers a slab use‑after‑free, a severe kernel‑memory corruption that can lead to kernel crash or execution of arbitrary code with privileged rights. The vulnerability is a classic CWE‑416 use‑after‑free.

Affected Systems

All Linux kernels that build the KVM driver with CONFIG_KVM and provide vendor modules on x86 are affected. The generic CPE indicates that any distribution using the standard Linux kernel with KVM support on x86 hardware—and any virtualized environment running kvm_intel or similar modules—must assess their version for this flaw.

Risk and Exploitability

The only way to reproduce the bug is by loading and unloading kernel modules, which requires a user with module‑operation privileges. Though no EPSS or KEV data are available, the type of memory corruption means a local attacker can trigger the use‑after‑free and potentially gain elevated privileges. Consequently, the vulnerability should be treated as high risk until proper mitigations are deployed.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`cb498ea2ce1d3f3c0bc0a2522241dca10263e437`	affected	< 6f4be73880302d5642c83a0813fdfe1f5fd4b6e3
`cb498ea2ce1d3f3c0bc0a2522241dca10263e437`	affected	< 32b9f89ed9e6d7a45075d64089c254a7f6e13695
`cb498ea2ce1d3f3c0bc0a2522241dca10263e437`	affected	< ec9daa8fd1b6f45545c9839dca55bd867fad9e13
`cb498ea2ce1d3f3c0bc0a2522241dca10263e437`	affected	< 43cfb20d62ffe49626d62beecfc32eb6f262191c
`cb498ea2ce1d3f3c0bc0a2522241dca10263e437`	affected	< 52f2f7c30126037975389aa04d24c506a5177c35

Linux

affected

Version	Status	Constraints
`2.6.25`	affected	—
`0`	unaffected	< 2.6.25
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2-rc5`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[cb498ea2ce1d3f3c0bc0a2522241dca10263e437,6f4be73880302d5642c83a0813fdfe1f5fd4b6e3)`	affected	code_commit	—
`[cb498ea2ce1d3f3c0bc0a2522241dca10263e437,32b9f89ed9e6d7a45075d64089c254a7f6e13695)`	affected	code_commit	—
`[cb498ea2ce1d3f3c0bc0a2522241dca10263e437,ec9daa8fd1b6f45545c9839dca55bd867fad9e13)`	affected	code_commit	—
`[cb498ea2ce1d3f3c0bc0a2522241dca10263e437,43cfb20d62ffe49626d62beecfc32eb6f262191c)`	affected	code_commit	—
`[cb498ea2ce1d3f3c0bc0a2522241dca10263e437,52f2f7c30126037975389aa04d24c506a5177c35)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.25`	affected	semver	—
`[0,2.6.25)`	unaffected	semver	—
`[6.6.148,6.7.0)`	unaffected	semver	—
`[6.12.101,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a release that incorporates the fix for CVE‑2026‑68428
If a kernel update cannot be applied immediately, restrict who can load or unload modules (e.g., enforce module‑load restrictions in the group policy or use restrictive kernel module parameters) to prevent the reload sequence from occurring
Ensure that any custom KVM or vendor modules are compiled against the patched kernel and that stale pointers are cleared during module exit as described in the upstream patch
Verify that the system architecture matches the affected x86 platform and that the KVM driver is enabled; if not in use, consider disabling KVM to eliminate the attack surface

Generated by OpenCVE AI on August 10, 2026 at 16:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/32b9f89ed9e6d7a45075d64089c254a7f6e13695
https://git.kernel.org/stable/c/43cfb20d62ffe49626d62beecfc32eb6f262191c
https://git.kernel.org/stable/c/52f2f7c30126037975389aa04d24c506a5177c35
https://git.kernel.org/stable/c/6f4be73880302d5642c83a0813fdfe1f5fd4b6e3
https://git.kernel.org/stable/c/ec9daa8fd1b6f45545c9839dca55bd867fad9e13

History

Mon, 10 Aug 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module reload mmu_destroy_caches() destroys pte_list_desc_cache and mmu_page_header_cache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor module is unloaded while kvm.ko remains loaded. If creation of pte_list_desc_cache fails during a subsequent vendor module load, its assignment sets pte_list_desc_cache to NULL and the error path calls mmu_destroy_caches(). mmu_page_header_cache still points to the cache destroyed during the preceding vendor module unload. Passing that stale pointer to kmem_cache_destroy() causes a slab use-after-free. Reproduce the issue on a v7.1.3 kernel with CONFIG_KASAN=y, CONFIG_KASAN_GENERIC=y, CONFIG_KVM=m, and CONFIG_KVM_INTEL=m. A one-shot test hook forces pte_list_desc_cache to NULL on the second invocation of kvm_mmu_vendor_module_init(): 1. Load kvm.ko and kvm-intel.ko, creating both caches. 2. Unload only kvm_intel, leaving kvm.ko loaded. 3. Reload kvm_intel and force initialization through the -ENOMEM path. KASAN reports: BUG: KASAN: slab-use-after-free in kvm_mmu_vendor_module_init+0x5b/0x170 [kvm] ... kmem_cache_destroy+0x21/0x1d0 kvm_mmu_vendor_module_init+0x5b/0x170 [kvm] ... Allocated by task 16817: __kmem_cache_create_args+0x12c/0x3b0 __kmem_cache_create.constprop.0+0xb6/0xf0 [kvm] kvm_mmu_vendor_module_init+0x13b/0x170 [kvm] ... Freed by task 16820: kmem_cache_destroy+0x117/0x1d0 kvm_mmu_vendor_module_exit+0x21/0x30 [kvm] Clear both pointers immediately after destroying their caches so that the stored state reflects the caches' lifetime and repeated cleanup is safe. With the fix applied, the same injected vendor module reload fails with -ENOMEM as expected and produces no KASAN report.
Title		KVM: x86/mmu: Fix use-after-free on vendor module reload
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/32b9f89ed9e6d7a45075d64089c254a7f6e13695 https://git.kernel.org/stable/c/43cfb20d62ffe49626d62beecfc32eb6f262191c https://git.kernel.org/stable/c/52f2f7c30126037975389aa04d24c506a5177c35 https://git.kernel.org/stable/c/6f4be73880302d5642c83a0813fdfe1f5fd4b6e3 https://git.kernel.org/stable/c/ec9daa8fd1b6f45545c9839dca55bd867fad9e13

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T12:04:48.905Z

Updated: 2026-08-10T12:04:48.905Z

Reserved: 2026-07-30T09:28:09.393Z

Link: CVE-2026-68428

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-11T01:45:06Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object