CVE-2026-43348

Vulnerability

In the Linux kernel's mshv_vtl subsystem, when registering VTL0 memory via MSHV_ADD_VTL0_MEMORY, the kernel computes pgmap->vmemmap_shift as the number of trailing zeros in the bitwise OR of start_pfn and last_pfn. This value is intended to select the largest compound page order that both endpoints are aligned to. However, the computed shift is not clamped to MAX_FOLIO_ORDER, so a sufficiently aligned memory range (e.g., physical range [0x800000000000, 0x800080000000) with 35 trailing zeros) can produce a shift larger than what memremap_pages() accepts, triggering a WARN and returning -EINVAL [1].

Exploitation

An attacker with the ability to trigger the registration of a highly aligned memory range (e.g., via the MSHV_ADD_VTL0_MEMORY ioctl) can cause the kernel to compute an out-of-range vmemmap_shift. This leads to a kernel warning and a failure of the memory registration operation, resulting in a denial of service (DoS) condition. No special privileges beyond the ability to issue the relevant ioctl are required, but the attack surface is limited to systems using the Microsoft Hyper-V VTL (Virtual Trust Level) feature.

Impact

A local attacker can cause a kernel WARN and prevent memory registration, leading to a denial of service. The impact is limited to availability; there is no evidence of memory corruption or privilege escalation. The CVSS v3 score of 5.5 (Medium) reflects this local DoS potential.

Mitigation

The fix clamps vmemmap_shift to MAX_FOLIO_ORDER so that the kernel always requests the largest supported order rather than an out-of-range value. Additionally, the error path is corrected to propagate the actual error code from devm_memremap_pages() instead of hard-coding -EFAULT, which was masking the real -EINVAL return [1]. The patch has been applied to the stable kernel tree and is available in commit 404cd6bffe17e25e0f94ed2775ffdd6cd10ac3fd [1]. Users should update to a kernel containing this fix.