CVE-2026-23402 in Linux
Summary
by MITRE • 04/01/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE
Adjust KVM's sanity check against overwriting a shadow-present SPTE with a another SPTE with a different target PFN to only apply to direct MMUs, i.e. only to MMUs without shadowed gPTEs. While it's impossible for KVM to overwrite a shadow-present SPTE in response to a guest write, writes from outside the scope of KVM, e.g. from host userspace, aren't detected by KVM's write tracking and so can break KVM's shadow paging rules.
------------[ cut here ]------------
pfn != spte_to_pfn(*sptep) WARNING: arch/x86/kvm/mmu/mmu.c:3069 at mmu_set_spte+0x1e4/0x440 [kvm], CPU#0: vmx_ept_stale_r/872
Modules linked in: kvm_intel kvm irqbypass CPU: 0 UID: 1000 PID: 872 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:mmu_set_spte+0x1e4/0x440 [kvm]
Call Trace: ept_page_fault+0x535/0x7f0 [kvm]
kvm_mmu_do_page_fault+0xee/0x1f0 [kvm]
kvm_mmu_page_fault+0x8d/0x620 [kvm]
vmx_handle_exit+0x18c/0x5a0 [kvm_intel]
kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm]
kvm_vcpu_ioctl+0x2d5/0x980 [kvm]
__x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0x730 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ---[ end trace 0000000000000000 ]---
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/01/2026
This vulnerability exists within the Linux kernel's KVM subsystem, specifically affecting the x86 memory management unit implementation. The issue manifests in the direct memory management unit (MMU) handling where the kernel incorrectly triggers a warning when attempting to overwrite a shadow-present shadow page table entry (SPTE) with another SPTE that references a different physical frame number (PFN). This condition occurs during memory management operations within virtualized environments where the kernel must maintain consistency between guest and host memory mappings.
The technical flaw stems from an overly aggressive sanity check that applies to all MMU types regardless of their operational context. In direct MMUs, which operate without shadowed guest page table entries, the kernel should not enforce strict validation when encountering potential conflicts between SPTEs. The vulnerability arises because the current implementation fails to distinguish between legitimate guest memory operations and external host modifications that may occur outside KVM's direct tracking mechanisms. This misclassification leads to false positive warnings that can disrupt system stability while not actually preventing legitimate memory management operations.
The operational impact of this vulnerability affects virtualized environments running on KVM hypervisors, particularly those utilizing Intel VT-x technology with EPT (Extended Page Tables). When external host processes attempt to modify memory mappings that conflict with existing shadow page table entries, the kernel generates unwarranted warnings that may propagate through the system. This can lead to performance degradation, increased logging overhead, and potential instability in virtual machine operations. The vulnerability is particularly concerning in high-throughput virtualization environments where memory operations occur frequently, as the false warnings can accumulate and impact overall system responsiveness.
The fix implemented addresses this by restricting the sanity check to only apply to direct MMUs, which are those without shadowed guest page table entries. This modification ensures that KVM's shadow paging rules are properly enforced only where they matter, while allowing legitimate external memory modifications to proceed without unnecessary interruption. The solution aligns with the principle of least privilege and proper separation of concerns within virtualization layers, preventing overzealous validation that could break legitimate memory management operations. This change reduces false positives while maintaining the integrity of KVM's memory management system, particularly in scenarios where host userspace operations may legitimately modify memory mappings that are not tracked by KVM's standard write tracking mechanisms. The vulnerability classification aligns with CWE-691, which deals with insufficient control flow management in virtualized environments, and relates to ATT&CK technique T1059.003 for execution through virtualization software manipulation.
This vulnerability demonstrates the complexity of maintaining memory consistency in virtualized environments where multiple layers of abstraction must coordinate without interference. The fix represents a careful balance between security enforcement and operational flexibility, recognizing that not all memory conflicts require immediate intervention. The change specifically targets the mmu_set_spte function in the KVM subsystem, modifying the validation logic to properly account for the different operational contexts of direct versus indirect MMUs. This approach ensures that KVM maintains its integrity while avoiding unnecessary disruptions to legitimate memory management operations that occur outside the direct scope of virtual machine execution tracking.