CVE-2026-53345

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying

When marking a page dirty, complain about not having a running/loaded vCPU

if and only if the VM is still alive, i.e. its refcount is non-zero. This

will allow fixing a memory leak for x86 SEV-ES guests without hitting what

is effectively a false positive on the WARN.

For some SEV-ES VM-Exits, KVM keeps a writable mapping of a guest page

across an exit to userspace, and typically unmaps the page on the next

KVM_RUN. But if userspace never calls KVM_RUN after such an exit, then KVM

needs to unmap the page when the vCPU is destroyed, which in turn triggers

the WARN about not having a running vCPU.

Alternatively, SEV-ES could temporarily load the vCPU to suppress the WARN,

as is done in nested_vmx_free_vcpu() (but for completely unrelated reasons;

suppressing WARN from nested_put_vmcs12_pages() is pure happenstance). But

loading a vCPU during

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References