CVE-2026-23401— KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
Possible ATT&CK Techniques 2AI
T1055.008 · Ptrace System Calls T1059 · Command and Scripting InterpreterAffected Version Matrix 16
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | a54aa15c6bda3ca7e2f9e040ba968a1da303e24f< 20656cd1f243d3a154aac5dd1b823110b6906fe1 | affected |
a54aa15c6bda3ca7e2f9e040ba968a1da303e24f< ed5909992f344a7d3f4024261e9f751d9618a27d | affected | ||
a54aa15c6bda3ca7e2f9e040ba968a1da303e24f< fd28c5618699180cd69619801e9ae6a5266c0a22 | affected | ||
a54aa15c6bda3ca7e2f9e040ba968a1da303e24f< 459158151a158a6703b49f3c9de0e536d8bd553f | affected | ||
a54aa15c6bda3ca7e2f9e040ba968a1da303e24f< 695320de6eadb75aaed8be1787c4ce4c189e4c7b | affected | ||
a54aa15c6bda3ca7e2f9e040ba968a1da303e24f< bce7fe59d43531623f3e43779127bfb33804925d | affected | ||
a54aa15c6bda3ca7e2f9e040ba968a1da303e24f< aad885e774966e97b675dfe928da164214a71605 | affected | ||
5.13 | affected | ||
| … +8 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-23401
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was right about it being impossible to convert a shadow-present SPTE to an MMIO SPTE due to a _guest_ write, it failed to account for writes to guest memory that are outside the scope of KVM. E.g. if host userspace modifies a shadowed gPTE to switch from a memslot to emulted MMIO and then the guest hits a relevant page fault, KVM will install the MMIO SPTE without first zapping the shadow-present SPTE. ------------[ cut here ]------------ is_shadow_present_pte(*sptep) WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292 Modules linked in: kvm_intel kvm irqbypass CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm] Call Trace: <TASK> mmu_set_spte+0x237/0x440 [kvm] ept_page_fault+0x535/0x7f0 [kvm] kvm_mmu_do_page_fault+0xee/0x1f0 [kvm] kvm_mmu_page_fault+0x8d/0x620 [kvm] vmx_handle_exit+0x18c/0x5a0 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0x730 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x47fa3f </TASK> ---[ end trace 0000000000000000 ]---
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于安装模拟MMIO SPTE时未先删除现有SPTE，可能导致内存损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-23401
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-23401
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-23401 (1)
Same Patch Batch · Linux · 2026-04-01 · 11 CVEs total
| CVE-2026-23411 | 7.8 HIGH | apparmor: fix race between freeing data and fs accessing it |
| CVE-2026-23410 | 7.8 HIGH | apparmor: fix race on rawdata dereference |
| CVE-2026-23408 | 7.8 HIGH | apparmor: Fix double free of ns_name in aa_replace_profiles() |
| CVE-2026-23407 | 7.8 HIGH | apparmor: fix missing bounds check on DEFAULT table in verify_dfa() |
| CVE-2026-23406 | 7.8 HIGH | apparmor: fix side-effect bug in match_char() macro usage |
| CVE-2026-23409 | apparmor: fix differential encoding verification | |
| CVE-2026-23405 | apparmor: fix: limit the number of levels of policy namespaces | |
| CVE-2026-23404 | apparmor: replace recursive profile removal with iterative approach | |
| CVE-2026-23403 | apparmor: fix memory leak in verify_header | |
| CVE-2026-23402 | KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE |
IV. Related Vulnerabilities
Same product: Linux
- CVE-2024-14040
net: nexthop: Increase weight to u16 - CVE-2026-64530
net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_han - CVE-2026-64529
crypto: qat - remove unused character device and IOCTLs - CVE-2026-64528
tty: serial: samsung: Remove redundant port lock acquisition - CVE-2026-64527
drm/hyperv: validate VMBus packet size in receive callback
Same vendor: Linux
- CVE-2024-14040
net: nexthop: Increase weight to u16 - CVE-2026-64530
net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_han - CVE-2026-64529
crypto: qat - remove unused character device and IOCTLs - CVE-2026-64528
tty: serial: samsung: Remove redundant port lock acquisition - CVE-2026-64527
drm/hyperv: validate VMBus packet size in receive callback
V. Comments for CVE-2026-23401
No comments yet