{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64561", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.796Z", "datePublished": "2026-08-04T06:23:21.094Z", "dateUpdated": "2026-08-09T03:38:12.274Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-09T03:38:12.274Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Check for invalid/obsolete root *after* making MMU pages available\n\nCheck for a \"stale\" page fault, i.e. for an invalid and/or obsolete root,\nafter making MMU pages available for the shadow MMU. If reclaiming shadow\npages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to\nmap memory into an invalid root. On its own, populating an invalid root is\n\"fine\", but because child shadow pages inherit their parent's role, any\nchildren created during the map/fetch will be created as invalid pages,\nthus violating KVM's invariant that invalid pages are never on the list of\nactive MMU pages.\n\nNote, the underlying flaw has existed since KVM first started tracking\ninvalid roots in 2008 (commit 2e53d63acba7, \"KVM: MMU: ignore zapped root\npagetables\"), but the true badness only came along in 2020 (Linux 5.9)\nwith the invariant that invalid shadow pages can't be on the list of\nactive pages.\n\nNote #2, inheriting role.invalid when creating child shadow pages is also\nfar from ideal; that flaw will be addressed separately."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable shadow-MMU page-fault path is reached via local KVM_RUN handling of guest EPT/shadow faults (and nested EPT via paging_tmpl), not by network or adjacent-radio packets.\nAC:L - An attacker who can run nested or shadow-MMU guests controls MMU pressure (heavy nested mappings and/or KVM_SET_NR_MMU_PAGES) and concurrent faults so reclaim zaps an in-use root during make_mmu_pages_available; no attacker-uncontrollable condition is required.\nPR:L - Exploitation needs /dev/kvm access or a nested-capable guest on the host, privileges commonly available to kvm-group users or cloud tenants, not real init-namespace root or CAP_SYS_ADMIN on the create/run path.\nUI:N - Once the attacker can run the guest, they trigger reclaim and page faults entirely through their own vCPU activity with no action by another user.\nS:C - Guest-controlled faults corrupt host KVM MMU state (invalid shadow pages on active_mmu_pages and subsequent list handling), crossing the guest-to-host virtualization boundary into the host kernel authority.\nC:H - Invalid children on active_mmu_pages break zap accounting assumptions so later prepare_zap list_add on still-linked entries corrupts kernel lists, a memory-corruption primitive that can be leveraged for arbitrary host reads.\nI:H - The same active-list invariant break and linked-list corruption in host MMU teardown/reclaim paths yield writable host corruption suitable for control-flow or structure hijacking, not merely a benign accounting glitch.\nA:H - WARN_ON_ONCE skips, infinite zap loops, list corruption, and host oops/hangs are reachable when invalid shadow pages remain on active_mmu_pages, causing host and co-located VM denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/mmu/mmu.c", "arch/x86/kvm/mmu/paging_tmpl.h"], "versions": [{"version": "f95eec9bed76d42194c23153cb1cc8f186bf91cb", "lessThan": "35e77467610c4a37cb0ff54ee56b85f73b1f5700", "status": "affected", "versionType": "git"}, {"version": "f95eec9bed76d42194c23153cb1cc8f186bf91cb", "lessThan": "0026dbb7de8ea76e97d6edf42fc3cc084564e2bf", "status": "affected", "versionType": "git"}, {"version": "f95eec9bed76d42194c23153cb1cc8f186bf91cb", "lessThan": "f3477a6a4164f15287444eda685b5f6405dbd1e5", "status": "affected", "versionType": "git"}, {"version": "f95eec9bed76d42194c23153cb1cc8f186bf91cb", "lessThan": "bce0d3c26e2c761a4bf43c8949f333fc7374eb2d", "status": "affected", "versionType": "git"}, {"version": "f95eec9bed76d42194c23153cb1cc8f186bf91cb", "lessThan": "2abd5287f08319fa35764566b15c6e22cb1068db", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/mmu/mmu.c", "arch/x86/kvm/mmu/paging_tmpl.h"], "versions": [{"version": "5.9", "status": "affected"}, {"version": "0", "lessThan": "5.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc5", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "7.2-rc5"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/35e77467610c4a37cb0ff54ee56b85f73b1f5700"}, {"url": "https://git.kernel.org/stable/c/0026dbb7de8ea76e97d6edf42fc3cc084564e2bf"}, {"url": "https://git.kernel.org/stable/c/f3477a6a4164f15287444eda685b5f6405dbd1e5"}, {"url": "https://git.kernel.org/stable/c/bce0d3c26e2c761a4bf43c8949f333fc7374eb2d"}, {"url": "https://git.kernel.org/stable/c/2abd5287f08319fa35764566b15c6e22cb1068db"}, {"url": "https://github.com/V4bel/Zapscape"}], "title": "KVM: x86: Check for invalid/obsolete root *after* making MMU pages available", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/x86/kvm/mmu/mmu.c", "arch/x86/kvm/mmu/paging_tmpl.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "35e77467610c4a37cb0ff54ee56b85f73b1f5700", "status": "affected", "version": "f95eec9bed76d42194c23153cb1cc8f186bf91cb", "versionType": "git"}, {"lessThan": "0026dbb7de8ea76e97d6edf42fc3cc084564e2bf", "status": "affected", "version": "f95eec9bed76d42194c23153cb1cc8f186bf91cb", "versionType": "git"}, {"lessThan": "f3477a6a4164f15287444eda685b5f6405dbd1e5", "status": "affected", "version": "f95eec9bed76d42194c23153cb1cc8f186bf91cb", "versionType": "git"}, {"lessThan": "bce0d3c26e2c761a4bf43c8949f333fc7374eb2d", "status": "affected", "version": "f95eec9bed76d42194c23153cb1cc8f186bf91cb", "versionType": "git"}, {"lessThan": "2abd5287f08319fa35764566b15c6e22cb1068db", "status": "affected", "version": "f95eec9bed76d42194c23153cb1cc8f186bf91cb", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/x86/kvm/mmu/mmu.c", "arch/x86/kvm/mmu/paging_tmpl.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.9"}, {"lessThan": "5.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.148", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2-rc5", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Check for invalid/obsolete root *after* making MMU pages available\n\nCheck for a \"stale\" page fault, i.e. for an invalid and/or obsolete root,\nafter making MMU pages available for the shadow MMU. If reclaiming shadow\npages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to\nmap memory into an invalid root. On its own, populating an invalid root is\n\"fine\", but because child shadow pages inherit their parent's role, any\nchildren created during the map/fetch will be created as invalid pages,\nthus violating KVM's invariant that invalid pages are never on the list of\nactive MMU pages.\n\nNote, the underlying flaw has existed since KVM first started tracking\ninvalid roots in 2008 (commit 2e53d63acba7, \"KVM: MMU: ignore zapped root\npagetables\"), but the true badness only came along in 2020 (Linux 5.9)\nwith the invariant that invalid shadow pages can't be on the list of\nactive pages.\n\nNote #2, inheriting role.invalid when creating child shadow pages is also\nfar from ideal; that flaw will be addressed separately."}], "id": "CVE-2026-64561", "lastModified": "2026-08-09T04:17:43.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-04T07:16:30.937", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0026dbb7de8ea76e97d6edf42fc3cc084564e2bf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2abd5287f08319fa35764566b15c6e22cb1068db"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/35e77467610c4a37cb0ff54ee56b85f73b1f5700"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bce0d3c26e2c761a4bf43c8949f333fc7374eb2d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f3477a6a4164f15287444eda685b5f6405dbd1e5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://github.com/V4bel/Zapscape"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available", "id": "2510891", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510891"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in KVM in the Linux kernel. This vulnerability occurs due to improper validation of memory management unit (MMU) page roots after these pages are made available. An attacker could exploit this by triggering a scenario where KVM attempts to map memory into an invalid root, causing child shadow pages to inherit an invalid state. This violates KVM's internal integrity rules, potentially leading to system instability or a denial of service within the virtualized environment."], "name": "CVE-2026-64561", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64561\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64561\nhttps://lore.kernel.org/linux-cve-announce/2026080401-CVE-2026-64561-d0d4@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f95eec9bed76d42194c23153cb1cc8f186bf91cb,35e77467610c4a37cb0ff54ee56b85f73b1f5700)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f95eec9bed76d42194c23153cb1cc8f186bf91cb,0026dbb7de8ea76e97d6edf42fc3cc084564e2bf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f95eec9bed76d42194c23153cb1cc8f186bf91cb,f3477a6a4164f15287444eda685b5f6405dbd1e5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f95eec9bed76d42194c23153cb1cc8f186bf91cb,bce0d3c26e2c761a4bf43c8949f333fc7374eb2d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f95eec9bed76d42194c23153cb1cc8f186bf91cb,2abd5287f08319fa35764566b15c6e22cb1068db)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.148,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.101,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-04T07:45:05.660564+00:00", "updated": "2026-08-08T17:00:05.211180+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}