Use-After-Free Vulnerability in Linux Kernel Affecting KVM x86 Products

CVE-2026-53359

What is CVE-2026-53359?

A vulnerability has been identified in the Linux kernel concerning the KVM x86 module, specifically a use-after-free scenario due to an unexpected role in shadow paging. This issue arises when a host modifies a Page Directory Entry (PDE) mapping from outside a guest virtual machine and subsequently drops a memory slot. As a result, the removal of certain entries fails due to a mismatch between the GFN of the shadow page table entry (SPTE) and that of the associated KVM memory management unit (MMU) page, potentially leading to dereferencing freed memory. This vulnerability underscores the importance of proper GFN handling and rigorous checks during memory allocations and deallocations within the kernel.

References