[PATCH 5.15.y v2 0/8] KVM: fixes for CVE-2026-46113 and related issues

[PATCH 5.15.y v2 0/8] KVM: fixes for CVE-2026-46113 and related issues

[Paolo Bonzini]

Sasha, Greg,

this is the backport to 5.15 for the above CVE.  The fix was relatively
simple upstream but only due to years of refactoring and cleaning up
of the code; fixing from scratch is not really feasible so start by
applying the patches that are needed.

Please apply this instead of v1, due to a missing line in the last
patch.  Sorry about that.

Paolo

David Matlack (2):
  KVM: x86/mmu: Use a bool for direct
  KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root()

Paolo Bonzini (5):
  KVM: x86/mmu: Derive shadow MMU page role from parent
  KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes
  KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page()
  KVM: x86: Fix shadow paging use-after-free due to unexpected role

Sean Christopherson (2):
  KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
  KVM: x86/mmu: Ensure hugepage is in by slot before checking max
    mapping level

 arch/x86/kvm/mmu/mmu.c         | 192 +++++++++++++++++++++------------
 arch/x86/kvm/mmu/paging_tmpl.h |  30 +++---
 arch/x86/kvm/mmu/spte.h        |   5 +
 arch/x86/kvm/vmx/vmx_ops.h     |   3 +-
 include/linux/kvm_host.h       |   7 +-
 5 files changed, 147 insertions(+), 90 deletions(-)

-- 
2.54.0

Re: [PATCH 5.15.y v2 0/8] KVM: fixes for CVE-2026-46113 and related issues

[Sasha Levin]

On Fri, 26 Jun 2026 19:46 +0200, Paolo Bonzini <pbonzini@redhat.com> wrote:
> [PATCH 5.15.y v2 0/8] KVM: fixes for CVE-2026-46113 and related issues
> Please apply this instead of v1, due to a missing line in the last patch.

Queued the v2 series for 5.15.

-- 
Thanks,
Sasha

Re: [PATCH 5.15.y v2 0/8] KVM: fixes for CVE-2026-46113 and related issues

[Kenta Akagi]

On 2026/06/28 1:35, Sasha Levin wrote:
> On Fri, 26 Jun 2026 19:46 +0200, Paolo Bonzini <pbonzini@redhat.com> wrote:
>> [PATCH 5.15.y v2 0/8] KVM: fixes for CVE-2026-46113 and related issues
>> Please apply this instead of v1, due to a missing line in the last patch.
> 
> Queued the v2 series for 5.15.

Hi Sasha,

It looks like 5.15.211 (released on July 4th) does not include this patch
series, and I don't see it in stable-queue/queue-5.15 either.

stable-queue$ rg -l "KVM: x86: Fix shadow paging use-after-free due to unexpected role" | sort -V
releases/6.1.177/kvm-x86-fix-shadow-paging-use-after-free-due-to-unex.patch
releases/6.6.144/kvm-x86-fix-shadow-paging-use-after-free-due-to-unex.patch
releases/6.12.95/kvm-x86-fix-shadow-paging-use-after-free-due-to-unex.patch
releases/6.18.38/kvm-x86-fix-shadow-paging-use-after-free-due-to-unex.patch
releases/7.1.3/kvm-x86-fix-shadow-paging-use-after-free-due-to-unex.patch

Could you please take a look?

Thanks,
Akagi

> 
> -- 
> Thanks,
> Sasha
> 
> 

Re: [PATCH 5.15.y v2 0/8] KVM: fixes for CVE-2026-46113 and related issues

[Sasha Levin]

On Fri, Jul 10, 2026 at 05:52:30AM +0000, Kenta Akagi wrote:
>On 2026/06/28 1:35, Sasha Levin wrote:
>> On Fri, 26 Jun 2026 19:46 +0200, Paolo Bonzini <pbonzini@redhat.com> wrote:
>>> [PATCH 5.15.y v2 0/8] KVM: fixes for CVE-2026-46113 and related issues
>>> Please apply this instead of v1, due to a missing line in the last patch.
>>
>> Queued the v2 series for 5.15.
>
>Hi Sasha,
>
>It looks like 5.15.211 (released on July 4th) does not include this patch
>series, and I don't see it in stable-queue/queue-5.15 either.
>
>stable-queue$ rg -l "KVM: x86: Fix shadow paging use-after-free due to unexpected role" | sort -V
>releases/6.1.177/kvm-x86-fix-shadow-paging-use-after-free-due-to-unex.patch
>releases/6.6.144/kvm-x86-fix-shadow-paging-use-after-free-due-to-unex.patch
>releases/6.12.95/kvm-x86-fix-shadow-paging-use-after-free-due-to-unex.patch
>releases/6.18.38/kvm-x86-fix-shadow-paging-use-after-free-due-to-unex.patch
>releases/7.1.3/kvm-x86-fix-shadow-paging-use-after-free-due-to-unex.patch
>
>Could you please take a look?

There were some issues found in this series, so we're waiting for a v2.

-- 
Thanks,
Sasha

Re: [PATCH 5.15.y v2 0/8] KVM: fixes for CVE-2026-46113 and related issues

[Sergey Senozhatsky]

> Sasha, Greg,
> 
> this is the backport to 5.15 for the above CVE.  The fix was relatively
> simple upstream but only due to years of refactoring and cleaning up
> of the code; fixing from scratch is not really feasible so start by
> applying the patches that are needed.
> 
> Please apply this instead of v1, due to a missing line in the last
> patch.  Sorry about that.

Sorry for the noise, has this series stuck?

Re: [PATCH 5.15.y v2 0/8] KVM: fixes for CVE-2026-46113 and related issues

[Sergey Senozhatsky]

On (26/07/23 15:36), Sergey Senozhatsky wrote:
> > Sasha, Greg,
> > 
> > this is the backport to 5.15 for the above CVE.  The fix was relatively
> > simple upstream but only due to years of refactoring and cleaning up
> > of the code; fixing from scratch is not really feasible so start by
> > applying the patches that are needed.
> > 
> > Please apply this instead of v1, due to a missing line in the last
> > patch.  Sorry about that.
> 
> Sorry for the noise, has this series stuck?

Sorry, forgot to set proper In-Reply-To [1]

https://lore.kernel.org/stable/20260626174620.1819772-1-pbonzini@redhat.com/

Re: [PATCH 5.15.y v2 0/8] KVM: fixes for CVE-2026-46113 and related issues

[Greg KH]

On Thu, Jul 23, 2026 at 03:39:15PM +0900, Sergey Senozhatsky wrote:
> On (26/07/23 15:36), Sergey Senozhatsky wrote:
> > > Sasha, Greg,
> > > 
> > > this is the backport to 5.15 for the above CVE.  The fix was relatively
> > > simple upstream but only due to years of refactoring and cleaning up
> > > of the code; fixing from scratch is not really feasible so start by
> > > applying the patches that are needed.
> > > 
> > > Please apply this instead of v1, due to a missing line in the last
> > > patch.  Sorry about that.
> > 
> > Sorry for the noise, has this series stuck?
> 
> Sorry, forgot to set proper In-Reply-To [1]
> 
> https://lore.kernel.org/stable/20260626174620.1819772-1-pbonzini@redhat.com/
> 

It needs backports for newer kernels first, right?  These seem to have
gotten stuck somewhere, they are gone from our review queues and so need
to be fixed up based on the review and resent if anyone wants them
applied.

thanks,

greg k-h

Re: [PATCH 5.15.y v2 0/8] KVM: fixes for CVE-2026-46113 and related issues

[Paolo Bonzini]

Il gio 23 lug 2026, 08:36 Sergey Senozhatsky
<senozhatsky@chromium.org> ha scritto:
>
> > Sasha, Greg,
> >
> > this is the backport to 5.15 for the above CVE.  The fix was relatively
> > simple upstream but only due to years of refactoring and cleaning up
> > of the code; fixing from scratch is not really feasible so start by
> > applying the patches that are needed.
> >
> > Please apply this instead of v1, due to a missing line in the last
> > patch.  Sorry about that.
>
> Sorry for the noise, has this series stuck?

It had a regression and while there was a suggestion about how to fix
it, nobody had time to verify it.
(https://lore.kernel.org/kvm/20260630223723.83727-1-zcgao@amazon.com/)

Stable releases, especially the older ones, are best effort. If you
want them to be free of these vulnerabilities, please contribute to
that effort with backports and tests.

Paolo

Re: [PATCH 5.15.y v2 0/8] KVM: fixes for CVE-2026-46113 and related issues

[Paolo Bonzini]

On 7/23/26 09:43, Greg KH wrote:
> On Thu, Jul 23, 2026 at 03:39:15PM +0900, Sergey Senozhatsky wrote:
>> On (26/07/23 15:36), Sergey Senozhatsky wrote:
>>>> Sasha, Greg,
>>>>
>>>> this is the backport to 5.15 for the above CVE.  The fix was relatively
>>>> simple upstream but only due to years of refactoring and cleaning up
>>>> of the code; fixing from scratch is not really feasible so start by
>>>> applying the patches that are needed.
>>>>
>>>> Please apply this instead of v1, due to a missing line in the last
>>>> patch.  Sorry about that.
>>>
>>> Sorry for the noise, has this series stuck?
>>
>> Sorry, forgot to set proper In-Reply-To [1]
>>
>> https://lore.kernel.org/stable/20260626174620.1819772-1-pbonzini@redhat.com/
>>
> 
> It needs backports for newer kernels first, right?

Backports up to 6.1 are trivial, if anyone posts them I'll ack them in a 
second.

Paolo

> These seem to have
> gotten stuck somewhere, they are gone from our review queues and so need
> to be fixed up based on the review and resent if anyone wants them
> applied.
> 
> thanks,
> 
> greg k-h
> 

Re: [PATCH 5.15.y v2 0/8] KVM: fixes for CVE-2026-46113 and related issues

[Sergey Senozhatsky]

Hello,
sorry for the delay,

On (26/07/23 15:36), Paolo Bonzini wrote:
> > > Sorry, forgot to set proper In-Reply-To [1]
> > > 
> > > https://lore.kernel.org/stable/20260626174620.1819772-1-pbonzini@redhat.com/
> > > 
> > 
> > It needs backports for newer kernels first, right?
> 
> Backports up to 6.1 are trivial, if anyone posts them I'll ack them in a
> second.

6.1, 6.6, 6.12 (and 7.x) already have

commit b1337aae5e194324e4810d561764e7793f8b3864
Author: Paolo Bonzini <pbonzini@redhat.com>
Date:   Fri Jun 26 13:24:36 2026 +0200

    KVM: x86: Fix shadow paging use-after-free due to unexpected role

commit e9d4ea13aa2b6400bb10ec64b370ba3dadcd22f0
Author: Sean Christopherson <seanjc@google.com>
Date:   Tue May 5 09:08:12 2026 +0200

    KVM: x86: Fix shadow paging use-after-free due to unexpected GFN

I suppose these patches are enough to address the vulnerability?


I can take a look at 5.10 and 5.15 backports but I likely will need
some help.

Re: [PATCH 5.15.y v2 0/8] KVM: fixes for CVE-2026-46113 and related issues

[Sergey Senozhatsky]

Hello,

On (26/07/23 11:36), Paolo Bonzini wrote:
> Il gio 23 lug 2026, 08:36 Sergey Senozhatsky
> <senozhatsky@chromium.org> ha scritto:
> >
> > > Sasha, Greg,
> > >
> > > this is the backport to 5.15 for the above CVE.  The fix was relatively
> > > simple upstream but only due to years of refactoring and cleaning up
> > > of the code; fixing from scratch is not really feasible so start by
> > > applying the patches that are needed.
> > >
> > > Please apply this instead of v1, due to a missing line in the last
> > > patch.  Sorry about that.
> >
> > Sorry for the noise, has this series stuck?
> 
> It had a regression and while there was a suggestion about how to fix
> it, nobody had time to verify it.
> (https://lore.kernel.org/kvm/20260630223723.83727-1-zcgao@amazon.com/)

I guess I can try helping with that.  Will require some time and
help tho.