CVE-2026-23402

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE

Adjust KVM's sanity check against overwriting a shadow-present SPTE with a

another SPTE with a different target PFN to only apply to direct MMUs,

i.e. only to MMUs without shadowed gPTEs. While it's impossible for KVM

to overwrite a shadow-present SPTE in response to a guest write, writes

from outside the scope of KVM, e.g. from host userspace, aren't detected

by KVM's write tracking and so can break KVM's shadow paging rules.

------------[ cut here ]------------

pfn != spte_to_pfn(*sptep)

WARNING: arch/x86/kvm/mmu/mmu.c:3069 at mmu_set_spte+0x1e4/0x440 [kvm], CPU#0: vmx_ept_stale_r/872

Modules linked in: kvm_intel kvm irqbypass

CPU: 0 UID: 1000 PID: 872 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015

RIP: 0010:mmu_set_spte+

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References