CVE-2026-80726 in Linux
Summary
by MITRE • 09/03/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
Explicitly clear role.invalid when deriving a child shadow page's role from its parent to harden against bugs elsewhere in KVM, as violating KVM's invariant that invalid pages are NOT on the list of active MMU pages leads to use-after-free due to __kvm_mmu_prepare_zap_page() using list_add() instead of list_move() when processing an invalid shadow page, i.e. makes a bad situation far worse.
Yell loudly if the parent is invalid, as it means KVM has missed a validity check, i.e. KVM is attempting to map memory using an invalid/obsolete root, but continue on as the child is otherwise still a valid shadow page.
================================================================== BUG: KASAN: slab-use-after-free in __kvm_mmu_get_shadow_page+0x1817/0x1860 [kvm]
Write of size 8 at addr ff11000153dd1368 by task repro/853
CPU: 1 UID: 1000 PID: 853 Comm: repro Not tainted 7.2.0-rc2-3aec122bdcaf-next-vm #5 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl+0x4b/0x70 print_report+0x153/0x49c kasan_report+0xbc/0xf0 __kvm_mmu_get_shadow_page+0x1817/0x1860 [kvm]
mmu_alloc_root+0x141/0x320 [kvm]
kvm_mmu_load+0x612/0x20f0 [kvm]
kvm_arch_vcpu_ioctl_run+0x3dd5/0x6150 [kvm]
kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm]
__x64_sys_ioctl+0x131/0x1b0 do_syscall_64+0x67/0x5f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK>
Allocated by task 853: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x5f/0x70 kmem_cache_alloc_noprof+0xfe/0x2e0 __kvm_mmu_topup_memory_cache+0x135/0x530 [kvm]
paging64_page_fault+0x318/0x1e30 [kvm]
kvm_mmu_do_page_fault+0x21d/0x630 [kvm]
kvm_mmu_page_fault+0x18c/0x17b0 [kvm]
kvm_arch_vcpu_ioctl_run+0x1f35/0x6150 [kvm]
kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm]
__x64_sys_ioctl+0x131/0x1b0 do_syscall_64+0x67/0x5f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
Freed by task 853: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x43/0x70 kmem_cache_free+0xe2/0x400 kvm_mmu_commit_zap_page.part.0+0x1e2/0x310 [kvm]
kvm_mmu_free_roots+0x283/0x560 [kvm]
kvm_arch_vcpu_ioctl_run+0x33c8/0x6150 [kvm]
kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm]
__x64_sys_ioctl+0x131/0x1b0 do_syscall_64+0x67/0x5f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The Linux kernel's Kernel-based Virtual Machine (KVM) subsystem contains a memory management vulnerability related to the handling of shadow page table roles during MMU initialization. The core issue arises when deriving the role for a child shadow page from its parent, where the validity flag within the page structure is not explicitly cleared if it was set in the parent context. This oversight violates a fundamental invariant maintained by KVM's memory management unit logic: that pages marked as invalid must never be present on the list of active MMU pages. When this invariant is breached due to improper role inheritance, subsequent operations assume the page is valid and actively managed, leading to critical state corruption within the kernel's slab allocator structures.
The technical flaw specifically manifests in the function responsible for retrieving or allocating shadow pages for guest virtual addresses. If a parent shadow page has been marked as invalid, typically because it was zapped or freed due to memory pressure or configuration changes, its child should not inherit this status without explicit handling. However, prior to the fix, the code did not clear the role.invalid flag when creating the child. Consequently, the system treats the newly created child shadow page as a valid, active entity and attempts to add it to the global list of active MMU pages using list_add(). This is incorrect because invalid pages are supposed to be excluded from this active set or handled via different logic that accounts for their transient nature. The presence of an invalid page on the active list creates a race condition where the memory associated with that page structure might have already been freed by another thread attempting to zap and free obsolete roots, yet the system continues to reference it as if it were live.
The operational impact of this vulnerability is severe, primarily resulting in a use-after-free error detectable via Kernel Address Sanitizer (KASAN). As evidenced by crash traces, the kernel attempts to write data into memory that has already been returned to the slab allocator for reuse. This corruption can lead to unpredictable system behavior, including virtual machine crashes, host kernel panics, or potentially arbitrary code execution if an attacker can control the contents of the reused memory slab. The vulnerability is triggered during normal VM operation when page faults occur and new shadow pages are allocated, particularly in scenarios involving rapid changes to guest memory mappings that cause roots to be freed while child structures are still being processed. This affects system stability and reliability for any workload running on KVM-enabled hosts using affected kernel versions.
From a security classification perspective, this vulnerability aligns with CWE-416: Use After Free, as the core issue involves accessing or manipulating memory after it has been made available for reallocation without proper synchronization or state validation. It also relates to CWE-20: Improper Input Validation, specifically regarding the failure to validate and sanitize internal structural flags before proceeding with list operations. In terms of attack vectors, this falls under ATT&CK technique T1499: Endpoint Denial of Service, as a local unprivileged user or a compromised guest VM could potentially trigger these conditions through crafted memory access patterns that induce frequent root zapping and subsequent shadow page allocation races. While the primary impact is denial of service via kernel crash, the underlying use-after-free nature poses theoretical risks for privilege escalation if the freed slab can be controlled by an attacker to overwrite critical kernel function pointers or security structures.
Mitigation strategies involve applying the upstream Linux kernel patch that explicitly clears the role.invalid flag when deriving a child shadow page's role from its parent. This ensures that even if the parent was invalid, the child is treated as a fresh entity with correct validity status before being added to any active lists. System administrators should update their KVM host kernels to versions containing this fix. Additionally, enabling Kernel Address Sanitizer (KASAN) in development or testing environments can help detect similar logic errors early by catching use-after-free and double-free conditions during VM workload execution. For production systems, ensuring that the hypervisor software is patched against known MMU race conditions remains the primary defense mechanism to maintain host integrity and prevent guest-induced denial of service attacks.