From 6e68f6600a758feebcc09d39b35e70dfd31f274e Mon Sep 17 00:00:00 2001 From: Sultan Alsawaf Date: Mon, 6 Jul 2026 20:12:00 -0700 Subject: [PATCH 1/2] KVM: x86: Fix shadow paging use-after-free due to unexpected GFN jira VULN-186742 cve CVE-2026-46113 commit-author Sean Christopherson commit 0cb2af2ea66ad8ff195c156ea690f11216285bdf upstream-diff | Upstream fixes this in kvm_mmu_get_child_sp() and __link_shadow_page(). Neither exists on this tree, so the fix goes into the open-coded interior-SPTE reuse in __direct_map() and FNAME(fetch). An existing interior SPTE is reused only when its child still maps the gfn about to be installed. Otherwise it's dropped and the correct child is installed. The shadow MMU computes GFNs for direct shadow pages using sp->gfn plus the SPTE index. This assumption breaks for shadow paging if the guest page tables are modified between VM entries (similar to commit aad885e77496, "KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE", 2026-03-27). The flow is as follows: - a PDE is installed for a 2MB mapping, and a page in that area is accessed. KVM creates a kvm_mmu_page consisting of 512 4KB pages; the kvm_mmu_page is marked by FNAME(fetch) as direct-mapped because the guest's mapping is a huge page (and thus contiguous). - the PDE mapping is changed from outside the guest. - the guest accesses another page in the same 2MB area. KVM installs a new leaf SPTE and rmap entry; the SPTE uses the "correct" GFN (i.e. based on the new mapping, as changed in the previous step) but that GFN is outside of the [sp->gfn, sp->gfn + 511] range; therefore the rmap entry cannot be found and removed when the kvm_mmu_page is zapped. - the memslot that covers the first 2MB mapping is deleted, and the kvm_mmu_page for the now-invalid GPA is zapped. However, rmap_remove() only looks at the [sp->gfn, sp->gfn + 511] range established in step 1, and fails to find the rmap entry that was recorded by step 3. - any operation that causes an rmap walk for the same page accessed by step 3 then walks a stale rmap and dereferences a freed kvm_mmu_page. This includes dirty logging or MMU notifier invalidations (e.g., from MADV_DONTNEED). The underlying issue is that KVM's walking of shadow PTEs assumes that if a SPTE is present when KVM wants to install a non-leaf SPTE, then the existing kvm_mmu_page must be for the correct gfn. Because the only way for the gfn to be wrong is if KVM messed up and failed to zap a SPTE... which shouldn't happen, but *actually* only happens in response to a guest write. That bug dates back literally forever, as even the first version of KVM assumes that the GFN matches and walks into the "wrong" shadow page. However, that was only an imprecision until 2032a93d66fa ("KVM: MMU: Don't allocate gfns page for direct mmu pages") came along. Fix it by checking for a target gfn mismatch and zapping the existing SPTE. That way the old SP and rmap entries are gone, KVM installs the rmap in the right location, and everyone is happy. Fixes: 2032a93d66fa ("KVM: MMU: Don't allocate gfns page for direct mmu pages") Fixes: 6aa8b732ca01 ("kvm: userspace interface") Reported-by: Alexander Bulekov Reported-by: Fred Griffoul Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Link: https://patch.msgid.link/20260503201029.106481-1-pbonzini@redhat.com/ Signed-off-by: Paolo Bonzini (cherry picked from commit 0cb2af2ea66ad8ff195c156ea690f11216285bdf) Signed-off-by: Sultan Alsawaf --- arch/x86/kvm/mmu/mmu.c | 54 ++++++++++++++++++---------------- arch/x86/kvm/mmu/paging_tmpl.h | 11 ++++--- 2 files changed, 34 insertions(+), 31 deletions(-) diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index b3e99eeab82f1..c73a30558f7f9 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -1169,29 +1169,6 @@ static void drop_spte(struct kvm *kvm, u64 *sptep) rmap_remove(kvm, sptep); } - -static bool __drop_large_spte(struct kvm *kvm, u64 *sptep) -{ - if (is_large_pte(*sptep)) { - WARN_ON(sptep_to_sp(sptep)->role.level == PG_LEVEL_4K); - drop_spte(kvm, sptep); - --kvm->stat.lpages; - return true; - } - - return false; -} - -static void drop_large_spte(struct kvm_vcpu *vcpu, u64 *sptep) -{ - if (__drop_large_spte(vcpu->kvm, sptep)) { - struct kvm_mmu_page *sp = sptep_to_sp(sptep); - - kvm_flush_remote_tlbs_with_address(vcpu->kvm, sp->gfn, - KVM_PAGES_PER_HPAGE(sp->role.level)); - } -} - /* * Write-protect on the specified @sptep, @pt_protect indicates whether * spte write-protection is caused by protecting shadow page table. @@ -2312,6 +2289,33 @@ static int mmu_page_zap_pte(struct kvm *kvm, struct kvm_mmu_page *sp, return 0; } +static bool kvm_mmu_child_sp_exists(u64 *sptep, gfn_t gfn) +{ + struct kvm_mmu_page *child; + + if (!is_shadow_present_pte(*sptep) || is_large_pte(*sptep)) + return false; + + child = to_shadow_page(*sptep & PT64_BASE_ADDR_MASK); + return child && child->gfn == gfn; +} + +static void drop_large_spte(struct kvm_vcpu *vcpu, u64 *sptep) +{ + struct kvm *kvm = vcpu->kvm; + struct kvm_mmu_page *parent_sp; + LIST_HEAD(invalid_list); + + if (!is_shadow_present_pte(*sptep)) + return; + + parent_sp = sptep_to_sp(sptep); + WARN_ON_ONCE(parent_sp->role.level == PG_LEVEL_4K); + + mmu_page_zap_pte(kvm, parent_sp, sptep, &invalid_list); + kvm_mmu_remote_flush_or_zap(kvm, &invalid_list, true); +} + static int kvm_mmu_page_unlink_children(struct kvm *kvm, struct kvm_mmu_page *sp, struct list_head *invalid_list) @@ -2997,10 +3001,10 @@ static int __direct_map(struct kvm_vcpu *vcpu, gpa_t gpa, u32 error_code, if (it.level == level) break; - drop_large_spte(vcpu, it.sptep); - if (is_shadow_present_pte(*it.sptep)) + if (kvm_mmu_child_sp_exists(it.sptep, base_gfn)) continue; + drop_large_spte(vcpu, it.sptep); sp = kvm_mmu_get_page(vcpu, base_gfn, it.addr, it.level - 1, true, ACC_ALL); diff --git a/arch/x86/kvm/mmu/paging_tmpl.h b/arch/x86/kvm/mmu/paging_tmpl.h index 6dbe890122d6e..088b78ebc5ab3 100644 --- a/arch/x86/kvm/mmu/paging_tmpl.h +++ b/arch/x86/kvm/mmu/paging_tmpl.h @@ -659,11 +659,11 @@ static int FNAME(fetch)(struct kvm_vcpu *vcpu, gpa_t addr, gfn_t table_gfn; clear_sp_write_flooding_count(it.sptep); - drop_large_spte(vcpu, it.sptep); + table_gfn = gw->table_gfn[it.level - 2]; sp = NULL; - if (!is_shadow_present_pte(*it.sptep)) { - table_gfn = gw->table_gfn[it.level - 2]; + if (!kvm_mmu_child_sp_exists(it.sptep, table_gfn)) { + drop_large_spte(vcpu, it.sptep); access = gw->pt_access[it.level - 2]; sp = kvm_mmu_get_page(vcpu, table_gfn, addr, it.level-1, false, access); @@ -721,9 +721,8 @@ static int FNAME(fetch)(struct kvm_vcpu *vcpu, gpa_t addr, validate_direct_spte(vcpu, it.sptep, direct_access); - drop_large_spte(vcpu, it.sptep); - - if (!is_shadow_present_pte(*it.sptep)) { + if (!kvm_mmu_child_sp_exists(it.sptep, base_gfn)) { + drop_large_spte(vcpu, it.sptep); sp = kvm_mmu_get_page(vcpu, base_gfn, addr, it.level - 1, true, direct_access); link_shadow_page(vcpu, it.sptep, sp); From bc85aebe3fa7f9ccbaa7ca451e671d2ac87df282 Mon Sep 17 00:00:00 2001 From: Sultan Alsawaf Date: Tue, 7 Jul 2026 00:32:01 -0700 Subject: [PATCH 2/2] KVM: x86: Fix shadow paging use-after-free due to unexpected role jira VULN-191426 cve CVE-2026-53359 commit-author Paolo Bonzini commit 81ccda30b4e83d8f5cc4fd50503c44e3a33abfeb upstream-diff | Upstream adds the check to kvm_mmu_get_child_sp(), which doesn't exist here, so it goes into kvm_mmu_child_sp_exists() at the reuse sites in __direct_map() and FNAME(fetch). The expected role comes from kvm_mmu_child_role(), split out of kvm_mmu_get_page() (as upstream did in 2e65e842c57d7) so the check and the allocator can't derive different roles. Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free. Fixes: 2032a93d66fa ("KVM: MMU: Don't allocate gfns page for direct mmu pages") Reported-by: Hyunwoo Kim Signed-off-by: Paolo Bonzini (cherry picked from commit 81ccda30b4e83d8f5cc4fd50503c44e3a33abfeb) Signed-off-by: Sultan Alsawaf --- arch/x86/kvm/mmu/mmu.c | 46 ++++++++++++++++++++++++---------- arch/x86/kvm/mmu/paging_tmpl.h | 8 +++--- 2 files changed, 38 insertions(+), 16 deletions(-) diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index c73a30558f7f9..f9d26c620f089 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -2053,20 +2053,13 @@ static void clear_sp_write_flooding_count(u64 *spte) __clear_sp_write_flooding_count(sptep_to_sp(spte)); } -static struct kvm_mmu_page *kvm_mmu_get_page(struct kvm_vcpu *vcpu, - gfn_t gfn, - gva_t gaddr, - unsigned level, - int direct, - unsigned int access) +static union kvm_mmu_page_role +kvm_mmu_child_role(struct kvm_vcpu *vcpu, gva_t gaddr, unsigned int level, + int direct, unsigned int access) { bool direct_mmu = vcpu->arch.mmu->direct_map; union kvm_mmu_page_role role; - struct hlist_head *sp_list; unsigned quadrant; - struct kvm_mmu_page *sp; - int collisions = 0; - LIST_HEAD(invalid_list); role = vcpu->arch.mmu->mmu_role.base; role.level = level; @@ -2080,6 +2073,25 @@ static struct kvm_mmu_page *kvm_mmu_get_page(struct kvm_vcpu *vcpu, role.quadrant = quadrant; } + return role; +} + +static struct kvm_mmu_page *kvm_mmu_get_page(struct kvm_vcpu *vcpu, + gfn_t gfn, + gva_t gaddr, + unsigned level, + int direct, + unsigned int access) +{ + bool direct_mmu = vcpu->arch.mmu->direct_map; + union kvm_mmu_page_role role; + struct hlist_head *sp_list; + struct kvm_mmu_page *sp; + int collisions = 0; + LIST_HEAD(invalid_list); + + role = kvm_mmu_child_role(vcpu, gaddr, level, direct, access); + sp_list = &vcpu->kvm->arch.mmu_page_hash[kvm_page_table_hashfn(gfn)]; for_each_valid_sp(vcpu->kvm, sp, sp_list) { if (sp->gfn != gfn) { @@ -2289,15 +2301,22 @@ static int mmu_page_zap_pte(struct kvm *kvm, struct kvm_mmu_page *sp, return 0; } -static bool kvm_mmu_child_sp_exists(u64 *sptep, gfn_t gfn) +static bool kvm_mmu_child_sp_exists(struct kvm_vcpu *vcpu, u64 *sptep, gfn_t gfn, + gva_t gaddr, unsigned int level, int direct, + unsigned int access) { + union kvm_mmu_page_role role; struct kvm_mmu_page *child; if (!is_shadow_present_pte(*sptep) || is_large_pte(*sptep)) return false; child = to_shadow_page(*sptep & PT64_BASE_ADDR_MASK); - return child && child->gfn == gfn; + if (!child) + return false; + + role = kvm_mmu_child_role(vcpu, gaddr, level, direct, access); + return child->gfn == gfn && child->role.word == role.word; } static void drop_large_spte(struct kvm_vcpu *vcpu, u64 *sptep) @@ -3001,7 +3020,8 @@ static int __direct_map(struct kvm_vcpu *vcpu, gpa_t gpa, u32 error_code, if (it.level == level) break; - if (kvm_mmu_child_sp_exists(it.sptep, base_gfn)) + if (kvm_mmu_child_sp_exists(vcpu, it.sptep, base_gfn, it.addr, + it.level - 1, true, ACC_ALL)) continue; drop_large_spte(vcpu, it.sptep); diff --git a/arch/x86/kvm/mmu/paging_tmpl.h b/arch/x86/kvm/mmu/paging_tmpl.h index 088b78ebc5ab3..714aceb173074 100644 --- a/arch/x86/kvm/mmu/paging_tmpl.h +++ b/arch/x86/kvm/mmu/paging_tmpl.h @@ -661,10 +661,11 @@ static int FNAME(fetch)(struct kvm_vcpu *vcpu, gpa_t addr, clear_sp_write_flooding_count(it.sptep); table_gfn = gw->table_gfn[it.level - 2]; + access = gw->pt_access[it.level - 2]; sp = NULL; - if (!kvm_mmu_child_sp_exists(it.sptep, table_gfn)) { + if (!kvm_mmu_child_sp_exists(vcpu, it.sptep, table_gfn, addr, + it.level - 1, false, access)) { drop_large_spte(vcpu, it.sptep); - access = gw->pt_access[it.level - 2]; sp = kvm_mmu_get_page(vcpu, table_gfn, addr, it.level-1, false, access); /* @@ -721,7 +722,8 @@ static int FNAME(fetch)(struct kvm_vcpu *vcpu, gpa_t addr, validate_direct_spte(vcpu, it.sptep, direct_access); - if (!kvm_mmu_child_sp_exists(it.sptep, base_gfn)) { + if (!kvm_mmu_child_sp_exists(vcpu, it.sptep, base_gfn, addr, + it.level - 1, true, direct_access)) { drop_large_spte(vcpu, it.sptep); sp = kvm_mmu_get_page(vcpu, base_gfn, addr, it.level - 1, true, direct_access);