CVE-2026-90040 Overview
CVE-2026-90040 is a Linux kernel vulnerability in the Kernel-based Virtual Machine (KVM) subsystem affecting AMD Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP) guests. The flaw resides in how KVM handles invalidation of the Virtual Machine Save Area (VMSA) when its backing guest_memfd (gmem) page is zapped. When a memslot is deleted, moved, or the gmem page is subjected to PUNCH_HOLE via fallocate(), KVM fails to force vCPUs to reload the guest-provided VMSA. This leaves the VMSA page marked in-use by firmware, causing RMPUPDATE to fail with FAIL_INUSE and triggering a Reverse Map Table (RMP) page fault on subsequent access.
Critical Impact
Host kernel warnings, RMP #PF crashes, and potential inability to reclaim SNP-assigned memory pages, degrading confidential VM host stability.
Affected Products
- Linux kernel builds shipping the KVM AMD (kvm_amd) module with SEV-SNP support
- Confidential computing hosts using guest_memfd-backed SEV-SNP guests
- Distributions tracking mainline KVM SEV-SNP feature enablement
Discovery Timeline
- 2026-09-16 - CVE-2026-90040 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-90040
Vulnerability Analysis
The vulnerability originates in the sev_gmem_invalidate() path of the KVM AMD module. SEV-SNP guests store their VMSA physical address in the vCPU control.vmsa_pa field, which firmware validates during VMRUN. When userspace issues fallocate(PUNCH_HOLE) against a guest_memfd inode backing a VMSA page, the kernel triggers truncate_inode_pages_range(), which calls into sev_gmem_invalidate() to release the page from the RMP. Because KVM did not previously wire a gmem_invalidate_range() callback for SNP VMs, vCPUs continued referencing the stale vmsa_pa. Firmware refused the RMPUPDATE call with error code 3 (FAIL_INUSE), leaving the page in an SNP-assigned state and producing the observed WARNING at arch/x86/kvm/svm/sev.c:5160 followed by a BUG: unable to handle page fault on the next access.
Root Cause
The root cause is a missing invalidation hook between the guest_memfd page cache lifecycle and the SNP VMSA mapping. KVM tracked VMSA installation but never revalidated the mapping when the backing memslot was DELETED or MOVED, or when the underlying gmem inode range was truncated. The VMSA reference in control.vmsa_pa outlived its backing page.
Attack Vector
A local user with permission to issue fallocate() operations on a guest_memfd inode used by an SNP VM, or with the ability to trigger memslot deletion/move, can drive the host into the faulting path. The patched flow snapshots the MMU notifier invalidation sequence counter, retrieves the pfn from guest_memfd, acquires mmu_lock for read, and re-requests a VMSA reload before committing. Failure to reload results in KVM_RUN returning an error and, in unpatched kernels, kernel warnings and a page fault at sev_gmem_invalidate+0x12b/0x170. See the upstream commit 2640cc26 and the companion commit d1a3c216 for the full fix.
Detection Methods for CVE-2026-90040
Indicators of Compromise
- Kernel log entries matching SEV-SNP: RMPUPDATE failed for PFN with ret: 3 (FAIL_INUSE).
- WARNING at arch/x86/kvm/svm/sev.c originating from sev_gmem_invalidate+.
- BUG: unable to handle page fault traces containing rmp_make_shared or delete_from_page_cache_batch frames.
- KVM_RUN ioctl returning failure for SNP guests after fallocate(PUNCH_HOLE) operations.
Detection Strategies
- Parse dmesg and journald for the SEV-SNP RMPUPDATE failure signature and correlate with SNP VM process IDs.
- Monitor kvm_amd module warnings via kernel tracepoints (kvm:kvm_entry, kvm:kvm_exit) on SNP hosts.
- Alert on abnormal fallocate syscalls (__x64_sys_fallocate) targeting guest_memfd file descriptors owned by VMM processes.
Monitoring Recommendations
- Ship kernel ring buffer and kvm_amd traces into a centralized logging pipeline for continuous review.
- Track SNP VM lifecycle events, including memslot DELETE and MOVE operations, alongside guest memory truncation events.
- Baseline expected RMP entry churn per host and alert when RMPUPDATE errors exceed the baseline.
How to Mitigate CVE-2026-90040
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in commits 2640cc26 and d1a3c216 to hosts running SEV-SNP workloads.
- Rebuild and reload the kvm_amd module after patching, then reboot affected hypervisors during a maintenance window.
- Audit VMM userspace code paths that call fallocate(PUNCH_HOLE) on guest_memfd inodes and restrict them to trusted processes.
Patch Information
The fix wires up gmem_invalidate_range() for SNP VMs and forces vCPUs to reload the guest-provided VMSA when the backing gmem page is invalidated. It also handles DELETED and MOVED memslot transitions. Refer to the Kernel Git commit 2640cc26 and the Kernel Git commit d1a3c216 for the authoritative source.
Workarounds
- Avoid issuing PUNCH_HOLEfallocate() operations against guest_memfd inodes backing running SNP VMs until patches are applied.
- Refrain from deleting or moving memslots bound to active SNP VMSAs during guest runtime.
- Restrict host access so only trusted VMM processes can manipulate guest_memfd descriptors on SNP-capable hosts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.