CVE-2026-53359

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Fix shadow paging use-after-free due to unexpected role

Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due

to unexpected GFN") fixed a shadow paging mismatch between stored and

computed GFNs; the bug could be triggered by changing a PDE mapping from

outside the guest, and then deleting a memslot. The rmap_remove()

call would miss entries created after the PDE change because the GFN

of the leaf SPTE does not match the GFN of the struct kvm_mmu_page.

A similar hole however remains if the modified PDE points to a non-leaf

page. In this case the gfn can be made to match, but the role does not

match: the original large 2MB page creates a kvm_mmu_page with direct=1,

while the new 4KB needs a kvm_mmu_page with direct=0. However,

kvm_mmu_get_child_sp() does not compare the role, and therefore reuses

the page.

The next step is installing a leaf (4KB) SPTE on the new path which

records an rmap

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References