CVE-2026-46113 Overview
CVE-2026-46113 is a use-after-free vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) x86 shadow paging implementation. The flaw resides in the shadow Memory Management Unit (MMU), which computes Guest Frame Numbers (GFNs) for direct shadow pages using sp->gfn plus the Shadow Page Table Entry (SPTE) index. When guest page tables are modified between VM entries, the assumption underpinning this computation breaks. The result is stale reverse mapping (rmap) entries that point to freed kvm_mmu_page structures. Subsequent rmap walks — triggered by dirty logging or MMU notifier invalidations such as MADV_DONTNEED — dereference freed memory.
Critical Impact
A malicious guest can trigger a use-after-free in the host kernel, potentially leading to host memory corruption, denial of service, or privilege escalation from guest to host.
Affected Products
- Linux kernel (x86 architecture) with KVM shadow paging
- Kernel versions predating commits 06c19c967b84, 0cb2af2ea66a, 14d1e55dfd2c, 488e386484ec, and 738ec97b1855
- Hypervisor hosts running KVM with shadow MMU enabled (non-EPT/NPT environments)
Discovery Timeline
- 2026-05-28 - CVE CVE-2026-46113 published to NVD
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-46113
Vulnerability Analysis
The KVM shadow MMU on x86 maintains kvm_mmu_page structures that mirror guest page tables. For direct-mapped shadow pages covering a 2MB huge-page region, KVM derives the GFN for each 4KB SPTE by adding the SPTE index to sp->gfn. This shortcut assumes the guest's mapping remains contiguous and consistent across VM entries.
The assumption fails when the guest modifies a Page Directory Entry (PDE) between accesses. KVM installs a new leaf SPTE using the updated GFN, but that GFN falls outside the [sp->gfn, sp->gfn + 511] range tracked by the original shadow page. The rmap entry is recorded under the new GFN while the shadow page still believes it owns only the original range.
When the memslot covering the original mapping is deleted, rmap_remove() walks only the original GFN range and fails to clean up the orphaned rmap entry. The kvm_mmu_page is freed while a stale rmap still references it.
Root Cause
The root cause is an unchecked invariant in the shadow MMU walker [CWE-416]. KVM assumes that if a non-leaf SPTE is present, the existing kvm_mmu_page corresponds to the correct GFN. Guest writes can invalidate that invariant, but the code path does not verify the target GFN before reusing the shadow page. The defect dates to the earliest KVM implementations and became exploitable after commit 2032a93d66fa removed per-page GFN tracking for direct shadow pages.
Attack Vector
An attacker with control of a guest virtual machine modifies guest page tables between VM entries to desynchronize shadow page GFN tracking. The attacker then triggers a memslot deletion or invokes operations that cause rmap walks — including dirty logging or MMU notifier invalidations via MADV_DONTNEED. The resulting dereference of a freed kvm_mmu_page corrupts host kernel memory.
The upstream fix checks for a target GFN mismatch when walking shadow PTEs and zaps the stale SPTE, ensuring the rmap is installed against the correct shadow page. See the kernel commit fix for the patched walker logic.
Detection Methods for CVE-2026-46113
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing rmap_remove, kvm_mmu_page, or FNAME(fetch) in dmesg output on KVM hosts
- KASAN use-after-free reports involving kvm_mmu_page allocations
- Guest-initiated workloads that repeatedly modify PDEs followed by memslot deletions or large MADV_DONTNEED calls
Detection Strategies
- Enable Kernel Address Sanitizer (KASAN) on test hypervisors to surface use-after-free conditions in the shadow MMU paths
- Audit running kernel versions across the virtualization fleet against the patched commit hashes published on git.kernel.org
- Monitor host kernel logs for KVM-related warnings, BUG_ON triggers, or general protection faults originating from MMU notifier callbacks
Monitoring Recommendations
- Collect and centralize dmesg and /var/log/kern.log from all KVM hosts for anomaly review
- Track guest behavior that aggressively manipulates page tables or invokes madvise() with MADV_DONTNEED at high frequency
- Alert on unexpected hypervisor reboots or VM termination events that may indicate triggered kernel faults
How to Mitigate CVE-2026-46113
Immediate Actions Required
- Identify KVM hosts running on x86 with shadow paging active (typically systems without hardware-assisted nested paging or where it is disabled)
- Apply the upstream Linux kernel patches referenced by commits 06c19c967b84, 0cb2af2ea66a, 14d1e55dfd2c, 488e386484ec, and 738ec97b1855
- Coordinate with Linux distribution vendors to deploy backported kernel updates across the virtualization fleet
- Restrict untrusted workloads from running as guests on unpatched hypervisors
Patch Information
The fix adds a target GFN mismatch check during shadow PTE walking. When the existing SPTE references a kvm_mmu_page whose GFN does not match the expected target, KVM zaps the existing SPTE before installing the new mapping. This ensures stale rmap entries are cleared and new entries are recorded against the correct shadow page. See the Linux kernel commit for the upstream patch and the additional stable backport commits.
Workarounds
- Enable hardware-assisted paging (Intel EPT or AMD NPT) where available, which avoids the vulnerable shadow MMU code path
- Limit guest workloads to trusted tenants until patches are applied
- Disable live migration and dirty logging on unpatched hosts to reduce the rmap walk surface
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
