CVE-2026-52969

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: Reject wrapped offset in kvm_reset_dirty_gfn()

kvm_reset_dirty_gfn() guards the gfn range with

if (!memslot || (offset + __fls(mask)) >= memslot->npages)

return;

but offset is u64 and the addition is unchecked. The check can be

silently bypassed by a u64 wrap.

The dirty ring backing those entries is MAP_SHARED at

KVM_DIRTY_LOG_PAGE_OFFSET of the vcpu fd, so the VMM can rewrite the

slot and offset fields of any entry between when the kernel pushes

them and when KVM_RESET_DIRTY_RINGS consumes them. On reset,

kvm_dirty_ring_reset() re-reads the values via READ_ONCE() and feeds

them straight back into this check; only the flags handshake is

treated as the handover, the slot/offset payload is taken on trust.

Crafting two entries

entry[i].offset = 0xffffffffffffffc1

entry[i+1].offset = 0

makes the coalescing loop in kvm_dirty_ring_reset() compute

delta = (s64)(0 - 0xffffffffffffffc1) = 63

which falls

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References