Vulnerability feed

Executive summary

A flaw in the Linux kernel's KVM virtualization code for x86 processors could let a guest cause memory writes that bypass KVM's write tracking. The advisory does not give a severity score, and it says the fix is to use the vCPU's active memslots when caching MMIO entries.

Technical summary

This is an incorrect-resource-selection flaw in the KVM per-vCPU MMIO cache, where the fill and validation paths use address space 0 even when the vCPU runs in SMM and uses address space 1. A stale cache entry can remain valid after an SMM memslot update, so an access to valid RAM can be returned to userspace as KVM_EXIT_MMIO, and completing that exit can write a nested EPT backing page without write-tracking, risking stale shadow translations. The advisory names commits 56f17dd3fbc4 and 699023e23965 as background. The fix is to use active memslots (kvm_vcpu_memslots()) for caching and validation. Affected and fixed kernel versions, a CVSS score, workarounds, and exploitation status are not stated. Detection guidance is not stated beyond a WARN_ON_ONCE() in kvm_mmu_write_protect_fault() that the advisory says catches the invalid combination.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Changed

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affects

LinuxKVMLinuxLinux kernelKVM