Re: 6.1.y status: 2abd5287f083 ("KVM: x86: Check for invalid/obsolete root *after* making MMU pages available") / CVE-2026-64561

[Sean Christopherson <seanjc@google.com>]

On Tue, Aug 11, 2026, IP over Parrots (with QoS) wrote:
> Hi,
> 
> Commit 2abd5287f083 ("KVM: x86: Check for invalid/obsolete root
> *after* making MMU pages available"), which landed in 7.2-rc5 and is
> tracked as CVE-2026-64561, does not appear to be present in
> linux-6.1.y as of 6.1.182.
> 
> I checked with:
> 
>   git log --oneline origin/linux-6.1.y --grep='invalid/obsolete root'
>   git log --oneline origin/linux-6.1.y --grep='2abd5287f083'
> 
> Neither returns a match and it doesn't seem to be in the queue.
> The commit message notes the invariant being violated was
> introduced in 5.9 by f95eec9bed76, so 6.1 looks in scope,
> and both hunks sit in direct_page_fault() and FNAME(page_fault)(),
> which appear structurally unchanged on that branch.
> 
> However the announcement[0] only mentions the fix landing in:
> - 6.6.148
> - 6.12.101
> - 6.18.42
> - 7.1.6
> - 7.2-rc2
> 
> Is a 6.1.y backport planned, or was it skipped deliberately?

Now planned.  The fix doesn't apply cleanly to 6.1, and the resolving the conflict
isn't super straightforward (though it's not thaaaat bad either).

https://lore.kernel.org/all/anpVAhjqvBvIuoa0@google.com

> The security tracker [1] for the Debian 12 stable kernel (6.1.y)
> shows a vulnerable status.
> 
> I do not have a backport to offer, so this is just an inquiry.
> I am happy to build and test a candidate on 6.1 if that would
> be useful.

I'll post a patch today and Cc you (unless I get goldfish brain, in which case
I apologize in advance).