CVE-2026-68166: Linux Kernel Privilege Escalation Flaw

CVE-2026-68166 Overview

CVE-2026-68166 is a Linux kernel vulnerability in the userfaultfd subsystem. The flaw allows userspace to register userfaultfd handlers on shadow stack Virtual Memory Areas (VMAs) and other special VMAs. Shadow stacks are a hardware-assisted control-flow integrity mechanism used to protect saved return addresses from tampering.

An attacker with userfaultfd access can register on a shadow stack VMA, discard a page, and then inject a page with attacker-chosen return addresses using the UFFDIO_COPY ioctl. This effectively bypasses shadow stack protections and enables control-flow hijacking primitives.

Critical Impact
Local userspace can subvert shadow stack integrity and inject arbitrary return addresses, undermining a core control-flow integrity defense.

Affected Products

Linux kernel versions implementing shadow stack support (VM_SHADOW_STACK) prior to the fix
Linux kernel branches missing commits 0c26202b157f, 165613191ad9, and 3c58f641e813
Systems that expose userfaultfd to unprivileged users

Discovery Timeline

Vulnerability reported by Vova Tokarev
2026-08-10 - CVE-2026-68166 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68166

Vulnerability Analysis

The userfaultfd mechanism lets userspace handle page faults for its own memory regions. When registering a VMA with userfaultfd, the kernel calls vma_can_userfault() to determine eligibility. The pre-patch check did not exclude shadow stack VMAs marked with VM_SHADOW_STACK, nor did it exclude VM_SPECIAL VMAs used by drivers.

Shadow stacks store return addresses out-of-band from the normal stack to detect return-oriented programming. Because shadow stack pages are writable only through specific architectural mechanisms, allowing userfaultfd registration provides an alternate write path that circumvents those hardware restrictions.

An attacker registers userfaultfd on a shadow stack region, evicts a page, and then supplies replacement contents through UFFDIO_COPY. The injected page contains attacker-chosen return addresses that the CPU trusts on subsequent RET instructions.

The EPSS score for this issue is 0.198% with a percentile of 9.817.

Root Cause

The vma_can_userfault() function in the kernel's memory management subsystem failed to filter out VMA flags that mark memory regions as special. Neither VM_SHADOW_STACK nor the broader VM_SPECIAL flag set were rejected, allowing registration on memory ranges that must remain under kernel or hardware control.

Attack Vector

Exploitation requires local access to a process that can invoke userfaultfd. On systems where vm.unprivileged_userfaultfd permits non-root use, any local user can trigger the primitive. The attacker registers userfaultfd against a shadow stack VMA and uses UFFDIO_COPY to write forged return addresses, then triggers execution paths that consume them.

The upstream fix updates vma_can_userfault() to reject VMAs with VM_SHADOW_STACK set. It also rejects VM_SPECIAL VMAs so that future drivers implementing vm_uffd_ops cannot register special regions. Because VM_SPECIAL includes VM_DONTEXPAND, which is also set on hugetlb VMAs, the check explicitly excludes hugetlb regions.

See the upstream commits for the exact code changes: commit 0c26202b157f, commit 165613191ad9, and commit 3c58f641e813.

Detection Methods for CVE-2026-68166

Indicators of Compromise

Unexpected userfaultfd syscall usage from unprivileged processes on systems with shadow stack enabled
Processes issuing UFFDIO_REGISTER followed by UFFDIO_COPY against memory ranges that overlap shadow stack allocations
Anomalous crashes or control-flow violations in hardened binaries that use arch_prctl(ARCH_SHSTK_ENABLE)

Detection Strategies

Audit syscall telemetry for userfaultfd() and related UFFDIO_* ioctls originating from unexpected binaries
Correlate userfaultfd registration events with the target VMA's flags where available from kernel tracing (ftrace, bpftrace)
Alert on execution of userfaultfd primitives inside sandboxed or least-privilege workloads that have no legitimate need for them

Monitoring Recommendations

Enable kernel auditing (auditd) rules for the userfaultfd syscall and review logs regularly
Track the value of vm.unprivileged_userfaultfd across the fleet and alert on hosts where it is set to 1
Monitor kernel versions with configuration management tooling to identify hosts running unpatched builds

How to Mitigate CVE-2026-68166

Immediate Actions Required

Apply the kernel updates that include the vma_can_userfault() fix from the referenced stable commits
Set vm.unprivileged_userfaultfd=0 via sysctl on hosts that do not require unprivileged use of the feature
Inventory workloads that rely on shadow stack (Intel CET / ARM GCS) protection and prioritize patching those hosts

Patch Information

The fix is available in the upstream Linux kernel through commits 0c26202b157f, 165613191ad9, and 3c58f641e813. Distribution vendors are backporting the changes to their supported stable branches; consult vendor advisories for the specific package versions.

Workarounds

Disable unprivileged userfaultfd by setting vm.unprivileged_userfaultfd=0 until patched kernels are deployed
Restrict container and sandbox seccomp profiles to block the userfaultfd syscall for workloads that do not need it
Where feasible, disable shadow stack for workloads that cannot be patched immediately to prevent silent bypass, understanding that this reduces defense-in-depth

bash

# Disable unprivileged userfaultfd usage system-wide
sudo sysctl -w vm.unprivileged_userfaultfd=0

# Persist the setting across reboots
echo 'vm.unprivileged_userfaultfd = 0' | sudo tee /etc/sysctl.d/90-userfaultfd.conf