{"api_version":"1","generated_at":"2026-08-04T13:51:35+00:00","cve":"CVE-2026-64561","urls":{"html":"https://cve.report/CVE-2026-64561","api":"https://cve.report/api/cve/CVE-2026-64561.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-64561","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-64561"},"summary":{"title":"KVM: x86: Check for invalid/obsolete root *after* making MMU pages available","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Check for invalid/obsolete root *after* making MMU pages available\n\nCheck for a \"stale\" page fault, i.e. for an invalid and/or obsolete root,\nafter making MMU pages available for the shadow MMU.  If reclaiming shadow\npages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to\nmap memory into an invalid root.  On its own, populating an invalid root is\n\"fine\", but because child shadow pages inherit their parent's role, any\nchildren created during the map/fetch will be created as invalid pages,\nthus violating KVM's invariant that invalid pages are never on the list of\nactive MMU pages.\n\nNote, the underlying flaw has existed since KVM first started tracking\ninvalid roots in 2008 (commit 2e53d63acba7, \"KVM: MMU: ignore zapped root\npagetables\"), but the true badness only came along in 2020 (Linux 5.9)\nwith the invariant that invalid shadow pages can't be on the list of\nactive pages.\n\nNote #2, inheriting role.invalid when creating child shadow pages is also\nfar from ideal; that flaw will be addressed separately.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-04 07:16:30","updated_at":"2026-08-04 07:16:30"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/0026dbb7de8ea76e97d6edf42fc3cc084564e2bf","name":"https://git.kernel.org/stable/c/0026dbb7de8ea76e97d6edf42fc3cc084564e2bf","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/bce0d3c26e2c761a4bf43c8949f333fc7374eb2d","name":"https://git.kernel.org/stable/c/bce0d3c26e2c761a4bf43c8949f333fc7374eb2d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/35e77467610c4a37cb0ff54ee56b85f73b1f5700","name":"https://git.kernel.org/stable/c/35e77467610c4a37cb0ff54ee56b85f73b1f5700","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2abd5287f08319fa35764566b15c6e22cb1068db","name":"https://git.kernel.org/stable/c/2abd5287f08319fa35764566b15c6e22cb1068db","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f3477a6a4164f15287444eda685b5f6405dbd1e5","name":"https://git.kernel.org/stable/c/f3477a6a4164f15287444eda685b5f6405dbd1e5","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64561","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64561","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f95eec9bed76d42194c23153cb1cc8f186bf91cb 35e77467610c4a37cb0ff54ee56b85f73b1f5700 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f95eec9bed76d42194c23153cb1cc8f186bf91cb 0026dbb7de8ea76e97d6edf42fc3cc084564e2bf git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f95eec9bed76d42194c23153cb1cc8f186bf91cb f3477a6a4164f15287444eda685b5f6405dbd1e5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f95eec9bed76d42194c23153cb1cc8f186bf91cb bce0d3c26e2c761a4bf43c8949f333fc7374eb2d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f95eec9bed76d42194c23153cb1cc8f186bf91cb 2abd5287f08319fa35764566b15c6e22cb1068db git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.9","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.9 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.148 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.101 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.42 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.6 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2-rc5 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kvm/mmu/mmu.c","arch/x86/kvm/mmu/paging_tmpl.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"35e77467610c4a37cb0ff54ee56b85f73b1f5700","status":"affected","version":"f95eec9bed76d42194c23153cb1cc8f186bf91cb","versionType":"git"},{"lessThan":"0026dbb7de8ea76e97d6edf42fc3cc084564e2bf","status":"affected","version":"f95eec9bed76d42194c23153cb1cc8f186bf91cb","versionType":"git"},{"lessThan":"f3477a6a4164f15287444eda685b5f6405dbd1e5","status":"affected","version":"f95eec9bed76d42194c23153cb1cc8f186bf91cb","versionType":"git"},{"lessThan":"bce0d3c26e2c761a4bf43c8949f333fc7374eb2d","status":"affected","version":"f95eec9bed76d42194c23153cb1cc8f186bf91cb","versionType":"git"},{"lessThan":"2abd5287f08319fa35764566b15c6e22cb1068db","status":"affected","version":"f95eec9bed76d42194c23153cb1cc8f186bf91cb","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kvm/mmu/mmu.c","arch/x86/kvm/mmu/paging_tmpl.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.9"},{"lessThan":"5.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.148","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2-rc5","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.148","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.101","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.42","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.6","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2-rc5","versionStartIncluding":"5.9","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Check for invalid/obsolete root *after* making MMU pages available\n\nCheck for a \"stale\" page fault, i.e. for an invalid and/or obsolete root,\nafter making MMU pages available for the shadow MMU.  If reclaiming shadow\npages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to\nmap memory into an invalid root.  On its own, populating an invalid root is\n\"fine\", but because child shadow pages inherit their parent's role, any\nchildren created during the map/fetch will be created as invalid pages,\nthus violating KVM's invariant that invalid pages are never on the list of\nactive MMU pages.\n\nNote, the underlying flaw has existed since KVM first started tracking\ninvalid roots in 2008 (commit 2e53d63acba7, \"KVM: MMU: ignore zapped root\npagetables\"), but the true badness only came along in 2020 (Linux 5.9)\nwith the invariant that invalid shadow pages can't be on the list of\nactive pages.\n\nNote #2, inheriting role.invalid when creating child shadow pages is also\nfar from ideal; that flaw will be addressed separately."}],"providerMetadata":{"dateUpdated":"2026-08-04T06:23:21.094Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/35e77467610c4a37cb0ff54ee56b85f73b1f5700"},{"url":"https://git.kernel.org/stable/c/0026dbb7de8ea76e97d6edf42fc3cc084564e2bf"},{"url":"https://git.kernel.org/stable/c/f3477a6a4164f15287444eda685b5f6405dbd1e5"},{"url":"https://git.kernel.org/stable/c/bce0d3c26e2c761a4bf43c8949f333fc7374eb2d"},{"url":"https://git.kernel.org/stable/c/2abd5287f08319fa35764566b15c6e22cb1068db"}],"title":"KVM: x86: Check for invalid/obsolete root *after* making MMU pages available","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-64561","datePublished":"2026-08-04T06:23:21.094Z","dateReserved":"2026-07-19T15:36:31.796Z","dateUpdated":"2026-08-04T06:23:21.094Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-04 07:16:30","lastModifiedDate":"2026-08-04 07:16:30","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"64561","Ordinal":"1","Title":"KVM: x86: Check for invalid/obsolete root *after* making MMU pag","CVE":"CVE-2026-64561","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"64561","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Check for invalid/obsolete root *after* making MMU pages available\n\nCheck for a \"stale\" page fault, i.e. for an invalid and/or obsolete root,\nafter making MMU pages available for the shadow MMU.  If reclaiming shadow\npages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to\nmap memory into an invalid root.  On its own, populating an invalid root is\n\"fine\", but because child shadow pages inherit their parent's role, any\nchildren created during the map/fetch will be created as invalid pages,\nthus violating KVM's invariant that invalid pages are never on the list of\nactive MMU pages.\n\nNote, the underlying flaw has existed since KVM first started tracking\ninvalid roots in 2008 (commit 2e53d63acba7, \"KVM: MMU: ignore zapped root\npagetables\"), but the true badness only came along in 2020 (Linux 5.9)\nwith the invariant that invalid shadow pages can't be on the list of\nactive pages.\n\nNote #2, inheriting role.invalid when creating child shadow pages is also\nfar from ideal; that flaw will be addressed separately.","Type":"Description","Title":"KVM: x86: Check for invalid/obsolete root *after* making MMU pag"}]}}}