Description
arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entries to resolve a guest virtual address, which allows L1 guest OS users to execute arbitrary code on the host OS or cause a denial of service (incorrect index during page walking, and host OS crash), aka an "MMU potential stack buffer overrun."
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Linux kernel | Linux kernel | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 4.13.4-2 | — |
| Debian 13 | linux | 4.13.4-2 | — |
| Debian 12 | linux | 4.13.4-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | linux-raspi-realtime | No fix yet | — |
| Ubuntu 22.04 LTS | linux-riscv +2 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +3 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +4 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-azure | 4.11.0-1015.15 | USN-3488-1 |
| Ubuntu 16.04 LTS | linux-gcp | 4.10.0-1009.9 | USN-3484-3 |
| Ubuntu 16.04 LTS | linux-hwe | 4.13.0-32.35~16.04.1 | USN-3484-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | kernel-rt +10 | 3.10.0-693.21.1.rt56.639.el7 | RHSA-2018:0412 |
| RHEL 7 | perf +18 | 3.10.0-693.21.1.el7 | RHSA-2018:0395 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | perf +11 | 3.10.0-693.21.1.el7 | ELSA-2018-0395 |
Advisories 6
- RHSA-2018:0412 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2018:0395 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- USN-3488-1 linux-azure vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-3484-2 linux-hwe vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-3484-3 linux-gcp vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- ELSA-2018-0395 Important: kernel security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Mar 7, 2018
References
- RHSA-2018:0412 vendor-advisory
- RHSA-2018:0395 vendor-advisory
- https://patchwork.kernel.org/patch/9996587/
- https://patchwork.kernel.org/patch/9996579/
- 101267 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1500380