CVE-2026-63806

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()

Drop a BUG_ON() that has been reachable since it was first added, way back

in 2009, and instead use get_unaligned() to perform potentially-unaligned

accesses.

For a given store, KVM x86's emulator tracks the entire value in the

destination operand, x86_emulate_ctxt.dst. If the destination is memory,

and the target splits multiple pages and/or is emulated MMIO, then KVM

handles each fragment independently. E.g. on a page split starting at page

offset 0xffc, KVM writes 4 bytes to the first page, then the remaining

bytes to the second page, using ctxt->dst as the source for both (with

appropriate offsets).

If the destination splits a page *and* hits emulated MMIO on the second

page, then KVM will complete the write to the first page, then emulate the

MMIO access to the second page. If there is a datamatch-enabled ioeventfd

at offset

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References