CVE-2026-90040

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped

Wire up a gmem_invalidate_range() call for SNP VMs, and use it to force

vCPUs to reload/recheck their guest-provided VMSA if the backing gmem

page is being invalidated, e.g. is being PUNCH_HOLE'd. Use the same core

logic to handle invalidations as VMX does for the APIC-access page, as the

two concepts are nearly identical: shove the physical address of a page

into the vCPU's control structure:

1. Snapshot the invalidation sequence counter

2. Grab the pfn (from guest_memfd in this case)

3. Acquire mmu_lock for read

4. Re-request reload if retry is needed, otherwise commit the change.

Note, the re-request action in #4 is necessary as KVM's retry logic is

fuzzy, i.e. can get false positives. If the guest_memfd page has been

dropped, at some point a subsequent reload will fail to get a PFN from

guest_memfd, and KVM will fail KVM_RUN. If

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References