Memory Access Vulnerability in KVM Module for Linux Kernel

CVE-2026-63807

What is CVE-2026-63807?

This vulnerability in the KVM module of the Linux kernel arises during the hugepage recovery process in the shadow memory management unit (MMU). When a hugepage is being recovered, the system fails to verify that the base guest frame number (gfn) lies within the bounds of the target memory slot prior to querying the maximum mapping level. As a result, this inconsistency can lead to an out-of-bounds memory access, which typically results in a fault error due to the incorrect memory location being accessed. If a guest system attempts to create a hugepage mapping extending beyond a memory slot, it may link to an invalid shadow page, escalating the risk of systemic instability and potential exploits.

References