6.1.y status: 2abd5287f083 ("KVM: x86: Check for invalid/obsolete root *after* making MMU pages available") / CVE-2026-64561

6.1.y status: 2abd5287f083 ("KVM: x86: Check for invalid/obsolete root *after* making MMU pages available") / CVE-2026-64561

[IP over Parrots (with QoS)]

Hi,

Commit 2abd5287f083 ("KVM: x86: Check for invalid/obsolete root
*after* making MMU pages available"), which landed in 7.2-rc5 and is
tracked as CVE-2026-64561, does not appear to be present in
linux-6.1.y as of 6.1.182.

I checked with:

  git log --oneline origin/linux-6.1.y --grep='invalid/obsolete root'
  git log --oneline origin/linux-6.1.y --grep='2abd5287f083'

Neither returns a match and it doesn't seem to be in the queue.
The commit message notes the invariant being violated was
introduced in 5.9 by f95eec9bed76, so 6.1 looks in scope,
and both hunks sit in direct_page_fault() and FNAME(page_fault)(),
which appear structurally unchanged on that branch.

However the announcement[0] only mentions the fix landing in:
- 6.6.148
- 6.12.101
- 6.18.42
- 7.1.6
- 7.2-rc2

Is a 6.1.y backport planned, or was it skipped deliberately?
The security tracker [1] for the Debian 12 stable kernel (6.1.y)
shows a vulnerable status.

I do not have a backport to offer, so this is just an inquiry.
I am happy to build and test a candidate on 6.1 if that would
be useful.

Thanks,

David Moreau-Simard

[0]: https://lore.kernel.org/linux-cve-announce/2026080401-CVE-2026-64561-d0d4@gregkh/T
[1]: https://security-tracker.debian.org/tracker/CVE-2026-64561

Re: 6.1.y status: 2abd5287f083 ("KVM: x86: Check for invalid/obsolete root *after* making MMU pages available") / CVE-2026-64561

[Sean Christopherson]

On Tue, Aug 11, 2026, IP over Parrots (with QoS) wrote:
> Hi,
> 
> Commit 2abd5287f083 ("KVM: x86: Check for invalid/obsolete root
> *after* making MMU pages available"), which landed in 7.2-rc5 and is
> tracked as CVE-2026-64561, does not appear to be present in
> linux-6.1.y as of 6.1.182.
> 
> I checked with:
> 
>   git log --oneline origin/linux-6.1.y --grep='invalid/obsolete root'
>   git log --oneline origin/linux-6.1.y --grep='2abd5287f083'
> 
> Neither returns a match and it doesn't seem to be in the queue.
> The commit message notes the invariant being violated was
> introduced in 5.9 by f95eec9bed76, so 6.1 looks in scope,
> and both hunks sit in direct_page_fault() and FNAME(page_fault)(),
> which appear structurally unchanged on that branch.
> 
> However the announcement[0] only mentions the fix landing in:
> - 6.6.148
> - 6.12.101
> - 6.18.42
> - 7.1.6
> - 7.2-rc2
> 
> Is a 6.1.y backport planned, or was it skipped deliberately?

Now planned.  The fix doesn't apply cleanly to 6.1, and the resolving the conflict
isn't super straightforward (though it's not thaaaat bad either).

https://lore.kernel.org/all/anpVAhjqvBvIuoa0@google.com

> The security tracker [1] for the Debian 12 stable kernel (6.1.y)
> shows a vulnerable status.
> 
> I do not have a backport to offer, so this is just an inquiry.
> I am happy to build and test a candidate on 6.1 if that would
> be useful.

I'll post a patch today and Cc you (unless I get goldfish brain, in which case
I apologize in advance).

Re: 6.1.y status: 2abd5287f083 ("KVM: x86: Check for invalid/obsolete root *after* making MMU pages available") / CVE-2026-64561

[Paolo Bonzini]

On Tue, Aug 11, 2026 at 3:43 PM IP over Parrots (with QoS)
<opensource@rfc2549.ca> wrote:
>
> Hi,
>
> Commit 2abd5287f083 ("KVM: x86: Check for invalid/obsolete root
> *after* making MMU pages available"), which landed in 7.2-rc5 and is
> tracked as CVE-2026-64561, does not appear to be present in
> linux-6.1.y as of 6.1.182.
>
> I checked with:
>
>   git log --oneline origin/linux-6.1.y --grep='invalid/obsolete root'
>   git log --oneline origin/linux-6.1.y --grep='2abd5287f083'
>
> Neither returns a match and it doesn't seem to be in the queue.
> The commit message notes the invariant being violated was
> introduced in 5.9 by f95eec9bed76, so 6.1 looks in scope,
> and both hunks sit in direct_page_fault() and FNAME(page_fault)(),
> which appear structurally unchanged on that branch.

Sean already answered about the backport; I will add that upstream
maintainers, as a general rule, do not have the bandwidth to check
which commits are needed in older backports. The older the kernel, the
more we need the help from the community. Especially with the
increased amount of reports we've gotten over the last few months,
*there's no guarantee that LTS kernels get fixes for all
vulnerabilities*. If your distro or fridge is running an old kernel
and is left vulnerable, complain with them.

Paolo

> However the announcement[0] only mentions the fix landing in:
> - 6.6.148
> - 6.12.101
> - 6.18.42
> - 7.1.6
> - 7.2-rc2
>
> Is a 6.1.y backport planned, or was it skipped deliberately?
> The security tracker [1] for the Debian 12 stable kernel (6.1.y)
> shows a vulnerable status.
>
> I do not have a backport to offer, so this is just an inquiry.
> I am happy to build and test a candidate on 6.1 if that would
> be useful.
>
> Thanks,
>
> David Moreau-Simard
>
> [0]: https://lore.kernel.org/linux-cve-announce/2026080401-CVE-2026-64561-d0d4@gregkh/T
> [1]: https://security-tracker.debian.org/tracker/CVE-2026-64561
>

Re: 6.1.y status: 2abd5287f083 ("KVM: x86: Check for invalid/obsolete root *after* making MMU pages available") / CVE-2026-64561

[Sean Christopherson]

+Sergey

On Tue, Aug 11, 2026, Sean Christopherson wrote:
> On Tue, Aug 11, 2026, IP over Parrots (with QoS) wrote:
> > Hi,
> > 
> > Commit 2abd5287f083 ("KVM: x86: Check for invalid/obsolete root
> > *after* making MMU pages available"), which landed in 7.2-rc5 and is
> > tracked as CVE-2026-64561, does not appear to be present in
> > linux-6.1.y as of 6.1.182.
> > 
> > I checked with:
> > 
> >   git log --oneline origin/linux-6.1.y --grep='invalid/obsolete root'
> >   git log --oneline origin/linux-6.1.y --grep='2abd5287f083'
> > 
> > Neither returns a match and it doesn't seem to be in the queue.
> > The commit message notes the invariant being violated was
> > introduced in 5.9 by f95eec9bed76, so 6.1 looks in scope,
> > and both hunks sit in direct_page_fault() and FNAME(page_fault)(),
> > which appear structurally unchanged on that branch.
> > 
> > However the announcement[0] only mentions the fix landing in:
> > - 6.6.148
> > - 6.12.101
> > - 6.18.42
> > - 7.1.6
> > - 7.2-rc2
> > 
> > Is a 6.1.y backport planned, or was it skipped deliberately?
> 
> Now planned.  The fix doesn't apply cleanly to 6.1, and the resolving the conflict
> isn't super straightforward (though it's not thaaaat bad either).
> 
> https://lore.kernel.org/all/anpVAhjqvBvIuoa0@google.com
> 
> > The security tracker [1] for the Debian 12 stable kernel (6.1.y)
> > shows a vulnerable status.
> > 
> > I do not have a backport to offer, so this is just an inquiry.
> > I am happy to build and test a candidate on 6.1 if that would
> > be useful.
> 
> I'll post a patch today and Cc you (unless I get goldfish brain, in which case
> I apologize in advance).

Actually, duh, Sasha already posted backports[*], and his approach is much better
than manually resolving the conflicts.  Testing that now, I'll ACK those assuming
all goes well.

[*] https://lore.kernel.org/all/20260730121535.2208491-1-sashal@kernel.org

Re: 6.1.y status: 2abd5287f083 ("KVM: x86: Check for invalid/obsolete root *after* making MMU pages available") / CVE-2026-64561

[IP over Parrots (with QoS)]

On Tuesday, August 11th, 2026 at 11:24 AM, Paolo Bonzini <pbonzini@redhat.com> wrote:
> Sean already answered about the backport; I will add that upstream
> maintainers, as a general rule, do not have the bandwidth to check
> which commits are needed in older backports. The older the kernel, the
> more we need the help from the community. Especially with the
> increased amount of reports we've gotten over the last few months,
> *there's no guarantee that LTS kernels get fixes for all
> vulnerabilities*.

That makes sense and I hope I didn't come across as complaining.
On the contrary I am willing to help to the extent that I can.

I am familiar with the maintenance burden but I am not intimate with
the inner workings of the Kernel yet so I figured I would ask the people
who know.

> If your distro or fridge is running an old kernel
> and is left vulnerable, complain with them.

To be fair, Debian 12 ships with 6.1.y which is still supported and they
have 6.1.182 already.

My inquiry was about whether this particular fix should land in 6.1.y.
Otherwise, if this was still supported by Debian (or RHEL), then I might
expect the distro to manually patch or backport it as you mention.

I now see that the fix will land and I am glad to have contributed in
some small way :)

Thanks all,

- dms