CVE-2026-63807

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level

When recovering hugepages in the shadow MMU, verify that the base gfn of

the shadow page is actually contained within the target memslot, *before*

querying the max mapping level given the shadow page's gfn. Failure to

pre-check the validity of the gfn can lead to an out-of-bounds access to

the slot's lpage_info (which typically manifests as a host #PF because the

lpage_info is vmalloc'd) if the guest creates a hugepage mapping (in its

PTEs) that extends "below" the bounds of a memslot.

When faulting in memory for a guest, and the size of the guest mapping is

greater than KVM's (current) max mapping, then KVM will create a "direct"

shadow page (direct in that there are no gPTEs to shadow, and so the target

gfn is a direct calculation given the base gfn of the shadow page). The

hugepage recovery flow looks for such direct shadow pages, as

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References