CVE-2026-68428: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68428 Overview

CVE-2026-68428 is a use-after-free vulnerability in the Linux kernel's Kernel-based Virtual Machine (KVM) x86 Memory Management Unit (MMU) subsystem. The flaw resides in mmu_destroy_caches(), which destroys the pte_list_desc_cache and mmu_page_header_cache slab caches but fails to reset their pointers to NULL. When a vendor module such as kvm-intel is unloaded while kvm.ko remains resident, stale pointers persist. A subsequent vendor module reload that fails during cache creation triggers kmem_cache_destroy() on a freed cache, producing a slab use-after-free confirmed by Kernel Address Sanitizer (KASAN).

Critical Impact
Local operators with kernel module load privileges can trigger a slab use-after-free in kvm.ko, corrupting kernel memory and potentially destabilizing virtualization hosts.

Affected Products

Linux kernel builds with CONFIG_KVM=m and a vendor module such as CONFIG_KVM_INTEL=m
Reproduced on Linux kernel v7.1.3 with CONFIG_KASAN=y and CONFIG_KASAN_GENERIC=y
Distributions shipping the affected kvm_mmu_vendor_module_init() code path prior to the referenced stable patches

Discovery Timeline

2026-08-10 - CVE-2026-68428 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68428

Vulnerability Analysis

The defect is a classic Use-After-Free in kernel slab management. mmu_destroy_caches() calls kmem_cache_destroy() on both pte_list_desc_cache and mmu_page_header_cache, freeing the underlying kmem_cache structures. However, the function leaves the global pointers unchanged. These pointers live inside kvm.ko, so they persist across the lifetime of vendor modules like kvm-intel or kvm-amd.

When a vendor module is later reloaded, kvm_mmu_vendor_module_init() attempts to recreate the caches. If the first allocation, pte_list_desc_cache, fails and returns NULL, the error path invokes mmu_destroy_caches() again. That cleanup then passes the stale mmu_page_header_cache pointer, which references an already-freed slab cache, into kmem_cache_destroy(). KASAN reports this as a slab-use-after-free in kvm_mmu_vendor_module_init+0x5b/0x170.

Root Cause

The root cause is missing state cleanup. mmu_destroy_caches() frees the cache objects but does not clear the module-scoped pointers. Because kvm.ko outlives vendor module unload cycles, the pointers carry dangling references into the next module load, breaking the invariant that a non-NULL pointer denotes a live cache.

Attack Vector

Exploitation requires local privileges sufficient to load and unload kernel modules, typically root or CAP_SYS_MODULE. An operator loads kvm.ko and kvm-intel.ko, unloads only kvm-intel, and then reloads it under conditions that force pte_list_desc_cache allocation to fail with -ENOMEM. The failing error path then dereferences the stale mmu_page_header_cache, corrupting slab metadata. The bug is not remotely reachable and depends on a memory-pressure or fault-injection condition during vendor module initialization.

See the upstream fix at Kernel Commit 32b9f89ed9 for the corrective patch that clears both pointers immediately after cache destruction.

Detection Methods for CVE-2026-68428

Indicators of Compromise

KASAN reports containing BUG: KASAN: slab-use-after-free in kvm_mmu_vendor_module_init in kernel logs
Kernel stack traces referencing kmem_cache_destroy invoked from kvm_mmu_vendor_module_exit followed by kvm_mmu_vendor_module_init
Repeated modprobe/rmmod cycles targeting kvm_intel or kvm_amd while kvm.ko remains loaded
Vendor module load failures returning -ENOMEM coinciding with slab corruption warnings in dmesg

Detection Strategies

Enable CONFIG_KASAN and CONFIG_KASAN_GENERIC on test kernels to surface the use-after-free at reproduction time
Monitor journalctl -k and /var/log/kern.log for slab-use-after-free signatures tied to kvm symbols
Audit module load telemetry to identify unexpected kvm_intel or kvm_amd unload/reload sequences on production hypervisors
Correlate KVM initialization failures (-ENOMEM) with subsequent kernel oops or panic events

Monitoring Recommendations

Collect kernel ring buffer output via centralized logging and alert on KASAN or slab corruption keywords
Track init_module and delete_module syscalls through auditd rules on virtualization hosts
Baseline the running kernel version across hypervisor fleets to identify hosts that have not received the stable patch

How to Mitigate CVE-2026-68428

Immediate Actions Required

Apply the upstream fix that clears pte_list_desc_cache and mmu_page_header_cache to NULL immediately after kmem_cache_destroy() in mmu_destroy_caches()
Update to a kernel build that incorporates the referenced stable commits, including Kernel Commit 43cfb20d62f and Kernel Commit 52f2f7c3012
Restrict CAP_SYS_MODULE and root access on virtualization hosts to trusted administrators only
Reboot hosts after patching to ensure the fixed kvm.ko is resident before workloads resume

Patch Information

The fix has been merged across multiple stable trees. Refer to Kernel Commit 6f4be738803 and Kernel Commit ec9daa8fd1b for the backported patches. The correction assigns NULL to both cache pointers immediately after destruction so that repeated cleanup paths remain idempotent. With the fix applied, a forced -ENOMEM during vendor module reload returns the expected error without producing a KASAN report.

Workarounds

Avoid unloading and reloading KVM vendor modules (kvm_intel, kvm_amd) on affected hosts until patches are applied
Disable module unloading by setting CONFIG_MODULE_UNLOAD=n in custom kernel builds where feasible
Use lockdown mode or Secure Boot with signed modules to restrict who can trigger the vulnerable code path

bash

# Confirm running kernel and KVM module status before patching
uname -r
lsmod | grep -E 'kvm|kvm_intel|kvm_amd'

# Restrict module operations to root only and audit them
chmod 700 /sbin/modprobe /sbin/rmmod
auditctl -a always,exit -F arch=b64 -S init_module -S delete_module -k kvm_module_changes