CVE-2026-23401

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE

When installing an emulated MMIO SPTE, do so *after* dropping/zapping the

existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was

right about it being impossible to convert a shadow-present SPTE to an

MMIO SPTE due to a _guest_ write, it failed to account for writes to guest

memory that are outside the scope of KVM.

E.g. if host userspace modifies a shadowed gPTE to switch from a memslot

to emulted MMIO and then the guest hits a relevant page fault, KVM will

install the MMIO SPTE without first zapping the shadow-present SPTE.

------------[ cut here ]------------

is_shadow_present_pte(*sptep)

WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292

Modules linked in: kvm_intel kvm irqbypass

CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References