CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Check for invalid/obsolete root *after* making MMU pages available

Check for a "stale" page fault, i.e. for an invalid and/or obsolete root,
after making MMU pages available for the shadow MMU.  If reclaiming shadow
pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to
map memory into an invalid root.  On its own, populating an invalid root is
"fine", but because child shadow pages inherit their parent's role, any
children created during the map/fetch will be created as invalid pages,
thus violating KVM's invariant that invalid pages are never on the list of
active MMU pages.

Note, the underlying flaw has existed since KVM first started tracking
invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root
pagetables"), but the true badness only came along in 2020 (Linux 5.9)
with the invariant that invalid shadow pages can't be on the list of
active pages.

Note #2, inheriting role.invalid when creating child shadow pages is also
far from ideal; that flaw will be addressed separately.

The Linux kernel CVE team has assigned CVE-2026-64561 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.9 with commit f95eec9bed76d42194c23153cb1cc8f186bf91cb and fixed in 6.6.148 with commit 35e77467610c4a37cb0ff54ee56b85f73b1f5700
	Issue introduced in 5.9 with commit f95eec9bed76d42194c23153cb1cc8f186bf91cb and fixed in 6.12.101 with commit 0026dbb7de8ea76e97d6edf42fc3cc084564e2bf
	Issue introduced in 5.9 with commit f95eec9bed76d42194c23153cb1cc8f186bf91cb and fixed in 6.18.42 with commit f3477a6a4164f15287444eda685b5f6405dbd1e5
	Issue introduced in 5.9 with commit f95eec9bed76d42194c23153cb1cc8f186bf91cb and fixed in 7.1.6 with commit bce0d3c26e2c761a4bf43c8949f333fc7374eb2d
	Issue introduced in 5.9 with commit f95eec9bed76d42194c23153cb1cc8f186bf91cb and fixed in 7.2-rc5 with commit 2abd5287f08319fa35764566b15c6e22cb1068db

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64561
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/x86/kvm/mmu/mmu.c
	arch/x86/kvm/mmu/paging_tmpl.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/35e77467610c4a37cb0ff54ee56b85f73b1f5700
	https://git.kernel.org/stable/c/0026dbb7de8ea76e97d6edf42fc3cc084564e2bf
	https://git.kernel.org/stable/c/f3477a6a4164f15287444eda685b5f6405dbd1e5
	https://git.kernel.org/stable/c/bce0d3c26e2c761a4bf43c8949f333fc7374eb2d
	https://git.kernel.org/stable/c/2abd5287f08319fa35764566b15c6e22cb1068db