CVE-2026-64561
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
Description
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to map memory into an invalid root. On its own, populating an invalid root is "fine", but because child shadow pages inherit their parent's role, any children created during the map/fetch will be created as invalid pages, thus violating KVM's invariant that invalid pages are never on the list of active MMU pages. Note, the underlying flaw has existed since KVM first started tracking invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root pagetables"), but the true badness only came along in 2020 (Linux 5.9) with the invariant that invalid shadow pages can't be on the list of active pages. Note #2, inheriting role.invalid when creating child shadow pages is also far from ideal; that flaw will be addressed separately.
INFO
Published Date :
Aug. 4, 2026, 7:16 a.m.
Last Modified :
Aug. 4, 2026, 7:16 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-64561
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Update the Linux kernel to the latest stable version.
- Apply the specific patch for the KVM MMU issue.
- Rebuild and deploy the updated kernel.
- Verify system stability and security.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-64561.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-64561 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-64561
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-64561 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-64561 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 04, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': '35e77467610c4a37cb0ff54ee56b85f73b1f5700', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': '0026dbb7de8ea76e97d6edf42fc3cc084564e2bf', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': 'f3477a6a4164f15287444eda685b5f6405dbd1e5', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': 'bce0d3c26e2c761a4bf43c8949f333fc7374eb2d', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': '2abd5287f08319fa35764566b15c6e22cb1068db', 'versionType': 'git'}], 'programFiles': ['arch/x86/kvm/mmu/mmu.c', 'arch/x86/kvm/mmu/paging_tmpl.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.9'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.9', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc5', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['arch/x86/kvm/mmu/mmu.c', 'arch/x86/kvm/mmu/paging_tmpl.h'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to map memory into an invalid root. On its own, populating an invalid root is "fine", but because child shadow pages inherit their parent's role, any children created during the map/fetch will be created as invalid pages, thus violating KVM's invariant that invalid pages are never on the list of active MMU pages. Note, the underlying flaw has existed since KVM first started tracking invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root pagetables"), but the true badness only came along in 2020 (Linux 5.9) with the invariant that invalid shadow pages can't be on the list of active pages. Note #2, inheriting role.invalid when creating child shadow pages is also far from ideal; that flaw will be addressed separately. Added Reference https://git.kernel.org/stable/c/0026dbb7de8ea76e97d6edf42fc3cc084564e2bf Added Reference https://git.kernel.org/stable/c/2abd5287f08319fa35764566b15c6e22cb1068db Added Reference https://git.kernel.org/stable/c/35e77467610c4a37cb0ff54ee56b85f73b1f5700 Added Reference https://git.kernel.org/stable/c/bce0d3c26e2c761a4bf43c8949f333fc7374eb2d Added Reference https://git.kernel.org/stable/c/f3477a6a4164f15287444eda685b5f6405dbd1e5