Re: 6.1.y status: 2abd5287f083 ("KVM: x86: Check for invalid/obsolete root *after* making MMU pages available") / CVE-2026-64561

[Sean Christopherson <seanjc@google.com>]

+Sergey

On Tue, Aug 11, 2026, Sean Christopherson wrote:
> On Tue, Aug 11, 2026, IP over Parrots (with QoS) wrote:
> > Hi,
> > 
> > Commit 2abd5287f083 ("KVM: x86: Check for invalid/obsolete root
> > *after* making MMU pages available"), which landed in 7.2-rc5 and is
> > tracked as CVE-2026-64561, does not appear to be present in
> > linux-6.1.y as of 6.1.182.
> > 
> > I checked with:
> > 
> >   git log --oneline origin/linux-6.1.y --grep='invalid/obsolete root'
> >   git log --oneline origin/linux-6.1.y --grep='2abd5287f083'
> > 
> > Neither returns a match and it doesn't seem to be in the queue.
> > The commit message notes the invariant being violated was
> > introduced in 5.9 by f95eec9bed76, so 6.1 looks in scope,
> > and both hunks sit in direct_page_fault() and FNAME(page_fault)(),
> > which appear structurally unchanged on that branch.
> > 
> > However the announcement[0] only mentions the fix landing in:
> > - 6.6.148
> > - 6.12.101
> > - 6.18.42
> > - 7.1.6
> > - 7.2-rc2
> > 
> > Is a 6.1.y backport planned, or was it skipped deliberately?
> 
> Now planned.  The fix doesn't apply cleanly to 6.1, and the resolving the conflict
> isn't super straightforward (though it's not thaaaat bad either).
> 
> https://lore.kernel.org/all/anpVAhjqvBvIuoa0@google.com
> 
> > The security tracker [1] for the Debian 12 stable kernel (6.1.y)
> > shows a vulnerable status.
> > 
> > I do not have a backport to offer, so this is just an inquiry.
> > I am happy to build and test a candidate on 6.1 if that would
> > be useful.
> 
> I'll post a patch today and Cc you (unless I get goldfish brain, in which case
> I apologize in advance).

Actually, duh, Sasha already posted backports[*], and his approach is much better
than manually resolving the conflicts.  Testing that now, I'll ACK those assuming
all goes well.

[*] https://lore.kernel.org/all/20260730121535.2208491-1-sashal@kernel.org