CVE-2026-23401
published 2026-04-01CVE-2026-23401: In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE When…
PriorityP423medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.18%
8.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
When installing an emulated MMIO SPTE, do so *after* dropping/zapping the
existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was
right about it being impossible to convert a shadow-present SPTE to an
MMIO SPTE due to a _guest_ write, it failed to account for writes to guest
memory that are outside the scope of KVM.
E.g. if host userspace modifies a shadowed gPTE to switch from a memslot
to emulted MMIO and then the guest hits a relevant page fault, KVM will
install the MMIO SPTE without first zapping the shadow-present SPTE.
------------[ cut here ]------------
is_shadow_present_pte(*sptep)
WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292
Modules linked in: kvm_intel kvm irqbypass
CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm]
Call Trace:
mmu_set_spte+0x237/0x440 [kvm]
ept_page_fault+0x535/0x7f0 [kvm]
kvm_mmu_do_page_fault+0xee/0x1f0 [kvm]
kvm_mmu_page_fault+0x8d/0x620 [kvm]
vmx_handle_exit+0x18c/0x5a0 [kvm_intel]
kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm]
kvm_vcpu_ioctl+0x2d5/0x980 [kvm]
__x64_sys_ioctl+0x8a/0xd0
do_syscall_64+0xb5/0x730
entry_SYSCALL_64_after_hwframe+0x4b/0x53
RIP: 0033:0x47fa3f
---[ end trace 0000000000000000 ]---
Affected
61 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.19.11-1 (sid) | linux 6.19.11-1 (sid) |
| linux | linux | — | — |
| linux | linux | >= a54aa15c6bda3ca7e2f9e040ba968a1da303e24f < 20656cd1f243d3a154aac5dd1b823110b6906fe1 | 20656cd1f243d3a154aac5dd1b823110b6906fe1 |
| linux | linux | >= a54aa15c6bda3ca7e2f9e040ba968a1da303e24f < ed5909992f344a7d3f4024261e9f751d9618a27d | ed5909992f344a7d3f4024261e9f751d9618a27d |
| linux | linux | >= a54aa15c6bda3ca7e2f9e040ba968a1da303e24f < fd28c5618699180cd69619801e9ae6a5266c0a22 | fd28c5618699180cd69619801e9ae6a5266c0a22 |
| linux | linux | >= a54aa15c6bda3ca7e2f9e040ba968a1da303e24f < 459158151a158a6703b49f3c9de0e536d8bd553f | 459158151a158a6703b49f3c9de0e536d8bd553f |
| linux | linux | >= a54aa15c6bda3ca7e2f9e040ba968a1da303e24f < 695320de6eadb75aaed8be1787c4ce4c189e4c7b | 695320de6eadb75aaed8be1787c4ce4c189e4c7b |
| linux | linux | >= a54aa15c6bda3ca7e2f9e040ba968a1da303e24f < bce7fe59d43531623f3e43779127bfb33804925d | bce7fe59d43531623f3e43779127bfb33804925d |
| linux | linux | >= a54aa15c6bda3ca7e2f9e040ba968a1da303e24f < aad885e774966e97b675dfe928da164214a71605 | aad885e774966e97b675dfe928da164214a71605 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 5.13.1 < 5.15.203 | 5.15.203 |
| linux | linux_kernel | >= 5.16 < 6.1.168 | 6.1.168 |
| linux | linux_kernel | >= 6.13 < 6.18.21 | 6.18.21 |
| linux | linux_kernel | >= 6.19 < 6.19.11 | 6.19.11 |
| linux | linux_kernel | >= 6.2 < 6.6.131 | 6.6.131 |
| linux | linux_kernel | >= 6.7 < 6.12.80 | 6.12.80 |
| msrc | azl3_kernel_6.6.130.1-3_on_azure_linux_3.0 | — | — |
| ubuntu | linux | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_msrc8.4HIGH
vendor_redhat8.1HIGH
vendor_ubuntu7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-28·CVSS 7.1
CVE-2024-36898 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local
Ubuntu
Linux kernel (HWE) vulnerabilities
vendor_ubuntu·2026-07-28·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (HWE) vulnerabilities
Title: Linux kernel (HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local a
Ubuntu
Linux kernel (Azure CVM) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (Azure CVM) vulnerabilities
Title: Linux kernel (Azure CVM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A l
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (Azure FIPS) vulnerabilities
Title: Linux kernel (Azure FIPS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A
Ubuntu
Linux kernel (Azure CVM) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 2.0
CVE-2026-43129 [LOW] Linux kernel (Azure CVM) vulnerabilities
Title: Linux kernel (Azure CVM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A l
Ubuntu
Linux kernel (Azure CVM) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 7.1
CVE-2024-36898 [HIGH] Linux kernel (Azure CVM) vulnerabilities
Title: Linux kernel (Azure CVM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cac
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local
Ubuntu
Linux kernel (AWS) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (AWS) vulnerabilities
Title: Linux kernel (AWS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local a
Ubuntu
Linux kernel (Oracle) vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (Oracle) vulnerabilities
Title: Linux kernel (Oracle) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A loca
Ubuntu
Linux kernel (NVIDIA) vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 2.0
CVE-2026-43129 [LOW] Linux kernel (NVIDIA) vulnerabilities
Title: Linux kernel (NVIDIA) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A loca
Ubuntu
Linux kernel (IBM) vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 7.1
CVE-2026-46187 [HIGH] Linux kernel (IBM) vulnerabilities
Title: Linux kernel (IBM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 7.1
CVE-2026-46187 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local
Ubuntu
Linux kernel (NVIDIA Tegra) vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 7.1
CVE-2026-46187 [HIGH] Linux kernel (NVIDIA Tegra) vulnerabilities
Title: Linux kernel (NVIDIA Tegra) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacke
Ubuntu
Linux kernel (GCP FIPS) vulnerabilities
vendor_ubuntu·2026-07-21·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (GCP FIPS) vulnerabilities
Title: Linux kernel (GCP FIPS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A lo
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-21·CVSS 7.1
CVE-2024-36898 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local
Ubuntu
Linux kernel (NVIDIA Tegra) vulnerabilities
vendor_ubuntu·2026-07-21·CVSS 7.1
CVE-2024-36898 [HIGH] Linux kernel (NVIDIA Tegra) vulnerabilities
Title: Linux kernel (NVIDIA Tegra) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacke
Microsoft
KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
vendor_msrc·2026-04-02·CVSS 8.4
CVE-2026-23401 [HIGH] KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Red Hat
kernel: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
vendor_redhat·2026-04-01·CVSS 8.1
CVE-2026-23401 [HIGH] CWE-416 kernel: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
kernel: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
When installing an emulated MMIO SPTE, do so *after* dropping/zapping the
existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was
right about it being impossible to convert a shadow-present SPTE to an
MMIO SPTE due to a _guest_ write, it failed to account for writes to guest
memory that are outside the scope of KVM.
E.g. if host userspace modifies a shadowed gPTE to switch from a memslot
to emulted MMIO and then the guest hits a relevant page fault, KVM will
install the MMIO SPTE without first zapping the shadow-present SPTE.
------------[ cut here
Debian
CVE-2026-23401: linux - In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mm...
vendor_debian·2026
CVE-2026-23401 CVE-2026-23401: linux - In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mm...
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was right about it being impossible to convert a shadow-present SPTE to an MMIO SPTE due to a _guest_ write, it failed to account for writes to guest memory that are outside the scope of KVM. E.g. if host userspace modifies a shadowed gPTE to switch from a memslot to emulted MMIO and then the guest hits a relevant page fault, KVM will install the MMIO SPTE without first zapping the shadow-present SPTE. ------------[ cut here ]------------ is_shadow_present_pte(*sptep) WARNING: arch/x86/kvm/mmu/mmu.c:484 at ma
VulDB
Linux Kernel up to 7.0-rc5 KVM is_shadow_present_pte memory corruption (EUVD-2026-17828 / Nessus ID 304626)
vuldb·2026-04-20
CVE-2026-23401 [CRITICAL] Linux Kernel up to 7.0-rc5 KVM is_shadow_present_pte memory corruption (EUVD-2026-17828 / Nessus ID 304626)
A vulnerability classified as critical has been found in Linux Kernel up to 7.0-rc5. Affected by this issue is the function is_shadow_present_pte of the component KVM. This manipulation causes memory corruption.
The identification of this vulnerability is CVE-2026-23401. The attack needs to be done within the local network. There is no exploit available.
It is recommended to upgrade the affected component.
GHSA
GHSA-2g4m-3wvw-crq2: In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
Whe
ghsa_unreviewed·2026-04-01
CVE-2026-23401 GHSA-2g4m-3wvw-crq2: In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
Whe
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
When installing an emulated MMIO SPTE, do so *after* dropping/zapping the
existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was
right about it being impossible to convert a shadow-present SPTE to an
MMIO SPTE due to a _guest_ write, it failed to account for writes to guest
memory that are outside the scope of KVM.
E.g. if host userspace modifies a shadowed gPTE to switch from a memslot
to emulted MMIO and then the guest hits a relevant page fault, KVM will
install the MMIO SPTE without first zapping the shadow-present SPTE.
------------[ cut here ]------------
is_shadow_present_pte(*sptep)
WARNING: arch/x86/kvm/mmu/mmu.c:484 a
OSV
CVE-2026-23401: In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE When
osv·2026-04-01
CVE-2026-23401 CVE-2026-23401: In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE When
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was right about it being impossible to convert a shadow-present SPTE to an MMIO SPTE due to a _guest_ write, it failed to account for writes to guest memory that are outside the scope of KVM. E.g. if host userspace modifies a shadowed gPTE to switch from a memslot to emulted MMIO and then the guest hits a relevant page fault, KVM will install the MMIO SPTE without first zapping the shadow-present SPTE. ------------[ cut here ]------------ is_shadow_present_pte(*sptep) WARNING: arch/x86/kvm/mmu/mmu.c:484 at ma
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-23401 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2026-23401 CVE-2026-23401 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-23401 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
When installing an emulated MMIO SPTE, do so after dropping/zapping the
existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was
right about it being impossible to convert a shadow-present SPTE to an
MMIO SPTE due to a guest write, it failed to account for writes to guest
memory that are outside the scope of KVM.
E.g. if host userspace modifies a shadowed gPTE to switch from a memslot
to emulted MMIO and then the guest hits a relevant page fault, KVM will
install the MMIO SPTE without first zapping the shadow-present SPTE.
------------[ cut here ]-----------
Wiz
ELSA-2026-1240 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.5
[MEDIUM] ELSA-2026-1240 Impact, Exploitability, and Mitigation Steps | Wiz
## ELSA-2026-1240 :
Linux Oracle vulnerability analysis and mitigation
ELSA-2026-1240: fence-agents security update (IMPORTANT)
Source : NVD
Published January 27, 2026
Severity HIGH
CNA Score N/A
Affected Technologies
Linux Oracle
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) N/A
Exploitation Probability (EPSS) N/A
Affected packages and libraries
fence-agents-compute
fence-agents-eps
Sources
NVD
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
## Related Linux Oracle vulnerabilities:
CVE ID
Severity
Score
Technologies
Component name
CISA KEV exploit
Has fix
Published date
CVE-20
Wiz
ELSA-2026-0991 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.5
[MEDIUM] ELSA-2026-0991 Impact, Exploitability, and Mitigation Steps | Wiz
## ELSA-2026-0991 :
Linux Oracle vulnerability analysis and mitigation
ELSA-2026-0991: glib2 security update (MODERATE)
Source : NVD
Published January 22, 2026
Severity MEDIUM
CNA Score N/A
Affected Technologies
Linux Oracle
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) N/A
Exploitation Probability (EPSS) N/A
Affected packages and libraries
glib2
glib2-devel
Sources
NVD
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
## Related Linux Oracle vulnerabilities:
CVE ID
Severity
Score
Technologies
Component name
CISA KEV exploit
Has fix
Published date
CVE-2026-4721
CRITICAL
9.8
Ni
Wiz
ELSA-2025-23141 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.5
[MEDIUM] ELSA-2025-23141 Impact, Exploitability, and Mitigation Steps | Wiz
## ELSA-2025-23141 :
Linux Oracle vulnerability analysis and mitigation
ELSA-2025-23141: ruby security update (MODERATE)
Source : NVD
Published December 11, 2025
Severity MEDIUM
CNA Score N/A
Affected Technologies
Linux Oracle
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) N/A
Exploitation Probability (EPSS) N/A
Affected packages and libraries
rubygem-minitest
rubygem-rbs
Sources
NVD
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
## Related Linux Oracle vulnerabilities:
CVE ID
Severity
Score
Technologies
Component name
CISA KEV exploit
Has fix
Published date
CVE-2026-4721
CRIT
Wiz
ELSA-2026-1592 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.5
[MEDIUM] ELSA-2026-1592 Impact, Exploitability, and Mitigation Steps | Wiz
## ELSA-2026-1592 :
Linux Oracle vulnerability analysis and mitigation
ELSA-2026-1592: iperf3 security update (MODERATE)
Source : NVD
Published January 29, 2026
Severity MEDIUM
CNA Score N/A
Affected Technologies
Linux Oracle
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) N/A
Exploitation Probability (EPSS) N/A
Affected packages and libraries
iperf3
Sources
NVD
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
## Related Linux Oracle vulnerabilities:
CVE ID
Severity
Score
Technologies
Component name
CISA KEV exploit
Has fix
Published date
CVE-2026-4721
CRITICAL
9.8
NixOS
Mozill
Wiz
ELSA-2026-0126 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.5
[MEDIUM] ELSA-2026-0126 Impact, Exploitability, and Mitigation Steps | Wiz
## ELSA-2026-0126 :
Linux Oracle vulnerability analysis and mitigation
ELSA-2026-0126: poppler security update (MODERATE)
Source : NVD
Published January 6, 2026
Severity MEDIUM
CNA Score N/A
Affected Technologies
Linux Oracle
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) N/A
Exploitation Probability (EPSS) N/A
Affected packages and libraries
poppler-cpp
poppler-devel
Sources
NVD
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
## Related Linux Oracle vulnerabilities:
CVE ID
Severity
Score
Technologies
Component name
CISA KEV exploit
Has fix
Published date
CVE-2026-4721
CRITICAL
Wiz
ELSA-2025-23139 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.5
[MEDIUM] ELSA-2025-23139 Impact, Exploitability, and Mitigation Steps | Wiz
## ELSA-2025-23139 :
Linux Oracle vulnerability analysis and mitigation
ELSA-2025-23139: libsoup3 security update (MODERATE)
Source : NVD
Published December 11, 2025
Severity MEDIUM
CNA Score N/A
Affected Technologies
Linux Oracle
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) N/A
Exploitation Probability (EPSS) N/A
Affected packages and libraries
libsoup3
libsoup3-devel
Sources
NVD
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
## Related Linux Oracle vulnerabilities:
CVE ID
Severity
Score
Technologies
Component name
CISA KEV exploit
Has fix
Published date
CVE-2026-4721
CRITI
Wiz
ELSA-2026-1595 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.5
[MEDIUM] ELSA-2026-1595 Impact, Exploitability, and Mitigation Steps | Wiz
## ELSA-2026-1595 :
Linux Oracle vulnerability analysis and mitigation
ELSA-2026-1595: iperf3 security update (MODERATE)
Source : NVD
Published January 29, 2026
Severity MEDIUM
CNA Score N/A
Affected Technologies
Linux Oracle
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) N/A
Exploitation Probability (EPSS) N/A
Affected packages and libraries
iperf3
Sources
NVD
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
## Related Linux Oracle vulnerabilities:
CVE ID
Severity
Score
Technologies
Component name
CISA KEV exploit
Has fix
Published date
CVE-2026-4721
CRITICAL
9.8
NixOS
Mozill
Wiz
CVE-2026-21991 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.5
CVE-2026-21991 [MEDIUM] CVE-2026-21991 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21991 :
Linux Oracle vulnerability analysis and mitigation
A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names.
Source : NVD
## 5.5
Score
Published March 16, 2026
Severity MEDIUM
CNA Score 5.5
Affected Technologies
Linux Oracle
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 1.9
Exploitation Probability (EPSS) N/A
Affected packages and libraries
dtrace
dtrace-devel
Sources
NVD
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
## Related Linux Oracle vulnerabilities:
CVE ID
Severity
Score
Technologies
Component name
CISA KEV
Wiz
ELSA-2026-1518 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.5
[MEDIUM] ELSA-2026-1518 Impact, Exploitability, and Mitigation Steps | Wiz
## ELSA-2026-1518 :
Linux Oracle vulnerability analysis and mitigation
ELSA-2026-1518: grafana-pcp security update (IMPORTANT)
Source : NVD
Published January 28, 2026
Severity HIGH
CNA Score N/A
Affected Technologies
Linux Oracle
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) N/A
Exploitation Probability (EPSS) N/A
Affected packages and libraries
grafana-pcp
Sources
NVD
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
## Related Linux Oracle vulnerabilities:
CVE ID
Severity
Score
Technologies
Component name
CISA KEV exploit
Has fix
Published date
CVE-2026-4721
CRITICAL
9.8
NixO
Wiz
ELSA-2026-1380 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.5
[MEDIUM] ELSA-2026-1380 Impact, Exploitability, and Mitigation Steps | Wiz
## ELSA-2026-1380 :
Linux Oracle vulnerability analysis and mitigation
ELSA-2026-1380: osbuild-composer security update (MODERATE)
Source : NVD
Published January 28, 2026
Severity MEDIUM
CNA Score N/A
Affected Technologies
Linux Oracle
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) N/A
Exploitation Probability (EPSS) N/A
Affected packages and libraries
osbuild-composer-core
osbuild-composer-worker
Sources
NVD
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
## Related Linux Oracle vulnerabilities:
CVE ID
Severity
Score
Technologies
Component name
CISA KEV exploit
Has fix
Published
Wiz
ELSA-2026-1852 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.5
[MEDIUM] ELSA-2026-1852 Impact, Exploitability, and Mitigation Steps | Wiz
## ELSA-2026-1852 :
Linux Oracle vulnerability analysis and mitigation
ELSA-2026-1852: util-linux security update (MODERATE)
Source : NVD
Published February 4, 2026
Severity MEDIUM
CNA Score N/A
Affected Technologies
Linux Oracle
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) N/A
Exploitation Probability (EPSS) N/A
Affected packages and libraries
libsmartcols-devel
util-linux-user
Sources
NVD
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
## Related Linux Oracle vulnerabilities:
CVE ID
Severity
Score
Technologies
Component name
CISA KEV exploit
Has fix
Published date
CVE-2026-4
Bugzilla
CVE-2026-23401 kernel: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
bugzilla·2026-04-01
CVE-2026-23401 [HIGH] CVE-2026-23401 kernel: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
CVE-2026-23401 kernel: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
When installing an emulated MMIO SPTE, do so *after* dropping/zapping the
existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was
right about it being impossible to convert a shadow-present SPTE to an
MMIO SPTE due to a _guest_ write, it failed to account for writes to guest
memory that are outside the scope of KVM.
E.g. if host userspace modifies a shadowed gPTE to switch from a memslot
to emulted MMIO and then the guest hits a relevant page fault, KVM will
install the MMIO SPTE without first zapping the shadow-present SPTE.
---
https://git.kernel.org/stable/c/20656cd1f243d3a154aac5dd1b823110b6906fe1https://git.kernel.org/stable/c/459158151a158a6703b49f3c9de0e536d8bd553fhttps://git.kernel.org/stable/c/695320de6eadb75aaed8be1787c4ce4c189e4c7bhttps://git.kernel.org/stable/c/aad885e774966e97b675dfe928da164214a71605https://git.kernel.org/stable/c/bce7fe59d43531623f3e43779127bfb33804925dhttps://git.kernel.org/stable/c/ed5909992f344a7d3f4024261e9f751d9618a27dhttps://git.kernel.org/stable/c/fd28c5618699180cd69619801e9ae6a5266c0a22https://access.redhat.com/errata/RHSA-2026:13577https://access.redhat.com/errata/RHSA-2026:13578https://access.redhat.com/errata/RHSA-2026:13932https://access.redhat.com/errata/RHSA-2026:13936https://access.redhat.com/errata/RHSA-2026:14137https://access.redhat.com/errata/RHSA-2026:14230https://access.redhat.com/errata/RHSA-2026:14339https://access.redhat.com/errata/RHSA-2026:15883https://access.redhat.com/errata/RHSA-2026:19521https://access.redhat.com/errata/RHSA-2026:19568https://access.redhat.com/errata/RHSA-2026:19569https://access.redhat.com/errata/RHSA-2026:19875https://access.redhat.com/errata/RHSA-2026:20593https://access.redhat.com/errata/RHSA-2026:36530https://access.redhat.com/errata/RHSA-2026:36531https://access.redhat.com/errata/RHSA-2026:36532https://access.redhat.com/errata/RHSA-2026:36533https://access.redhat.com/errata/RHSA-2026:36534https://access.redhat.com/security/cve/CVE-2026-23401https://bugzilla.redhat.com/show_bug.cgi?id=2453803https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23401.json
2026-04-01
Published