CVE-2026-23402

The vulnerability is a bug in the Linux kernel's KVM x86 memory management unit (MMU). The function mmu_set_spte contains a sanity check that warns when a shadow-present SPTE (Shadow Page Table Entry) is overwritten with a different target PFN. This check was intended to catch unexpected guest writes, but it incorrectly triggers for writes originating from outside KVM, such as from host userspace via /dev/kvm or other interfaces. The warning is a WARN_ONCE that can flood kernel logs.

Exploitation does not require guest interaction; an attacker with access to the host userspace (e.g., a malicious VM process) can trigger the warning by performing a write that causes KVM to overwrite a shadow-present SPTE. The attack surface is the KVM device interface, which is typically accessible to users with appropriate permissions. No special authentication is needed beyond the ability to open /dev/kvm and run a VM.

The impact is limited to a kernel warning (WARN) that may cause denial of service through log flooding or system instability if panic_on_warn is set. The warning itself does not directly lead to memory corruption or privilege escalation, but it indicates a violation of KVM's internal invariants. The fix adjusts the sanity check to only apply to direct MMUs (those without shadowed guest page tables), preventing false positives.

The fix has been applied to the Linux kernel stable trees via commits [1], [2], [3]. Users should update to a kernel version containing these patches. No workaround is documented; the issue is resolved by the kernel update.