Description
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
Check for a "stale" page fault, i.e. for an invalid and/or obsolete root,
after making MMU pages available for the shadow MMU. If reclaiming shadow
pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to
map memory into an invalid root. On its own, populating an invalid root is
"fine", but because child shadow pages inherit their parent's role, any
children created during the map/fetch will be created as invalid pages,
thus violating KVM's invariant that invalid pages are never on the list of
active MMU pages.
Note, the underlying flaw has existed since KVM first started tracking
invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root
pagetables"), but the true badness only came along in 2020 (Linux 5.9)
with the invariant that invalid shadow pages can't be on the list of
active pages.
Note #2, inheriting role.invalid when creating child shadow pages is also
far from ideal; that flaw will be addressed separately.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 5.9 | 5.15.218 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 7.1.6-1 | — |
| Debian 13 | linux | 6.12.101-1 | — |
| Debian 12 | linux | 6.1.187-1 | — |
| Debian 12 | linux-6.12 | 6.12.101-1~deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 24.04 LTS | linux-bluefield | 6.8.0-1033.38 | — |
| Ubuntu Nvidia-BlueField 22.04 LTS | linux-bluefield | 5.15.0-1103.105 | — |
| Ubuntu 26.04 LTS | linux | 7.0.0-38.38 | USN-8887-1 |
| Ubuntu 26.04 LTS | linux-aws +1 | 7.0.0-1014.14 | USN-8887-1 |
| Ubuntu 26.04 LTS | linux-azure | 7.0.0-1017.17 | USN-8888-1 |
| Ubuntu 26.04 LTS | linux-azure-fde | 7.0.0-1016.16 | USN-8888-1 |
| Ubuntu 26.04 LTS | linux-gke | 7.0.0-1008.9 | USN-8887-1 |
| Ubuntu 26.04 LTS | linux-ibm +1 | 7.0.0-1015.15 | USN-8889-1, USN-8887-1 |
| Ubuntu 26.04 LTS | linux-nvidia | 7.0.0-1025.26 | USN-9043-1 |
| Ubuntu 26.04 LTS | linux-nvidia-bos | 7.0.0-2022.23 | USN-9003-1 |
| Ubuntu 26.04 LTS | linux-oracle | 7.0.0-1013.13 | USN-8887-1 |
| Ubuntu 26.04 LTS | linux-raspi | 7.0.0-1023.23 | USN-9021-1 |
| Ubuntu 26.04 LTS | linux-riscv +1 | 7.0.0-38.38.1 | USN-8887-1 |
| Ubuntu 24.04 LTS | linux | 6.8.0-147.147 | USN-8917-1 |
| Ubuntu 24.04 LTS | linux-aws +1 | 6.8.0-1067.70 | USN-9024-1, USN-8917-1 |
| Ubuntu 24.04 LTS | linux-aws-7.0 +1 | 7.0.0-1014.14~24.04.1 | USN-8887-3, USN-8887-2 |
| Ubuntu 24.04 LTS | linux-azure-7.0 | 7.0.0-1017.17~24.04.1 | USN-8888-2 |
| Ubuntu 24.04 LTS | linux-azure-fde | 6.8.0-1069.76 | USN-8918-1 |
| Ubuntu 24.04 LTS | linux-azure-fde-7.0 | 7.0.0-1016.16~24.04.1 | USN-8888-2 |
| Ubuntu 24.04 LTS | linux-gcp +1 | 6.8.0-1071.79 | USN-8918-1, USN-8917-1 |
| Ubuntu 24.04 LTS | linux-gke | 6.8.0-1066.74 | USN-8917-1 |
| Ubuntu 24.04 LTS | linux-gkeop | 6.8.0-1052.56 | USN-8917-1 |
| Ubuntu 24.04 LTS | linux-hwe-7.0 | 7.0.0-38.38~24.04.4 | USN-8887-3 |
| Ubuntu 24.04 LTS | linux-ibm | 6.8.0-1067.68 | USN-8917-1 |
| Ubuntu 24.04 LTS | linux-lowlatency | 6.8.0-147.147.1 | USN-8917-1 |
| Ubuntu 24.04 LTS | linux-nvidia-7.0 | 7.0.0-1024.25~24.04.1 | USN-9003-1 |
| Ubuntu 24.04 LTS | linux-nvidia-lowlatency | 6.8.0-1067.70.1 | USN-9040-1 |
| Ubuntu 24.04 LTS | linux-nvidia-tegra | 6.8.0-1035.38 | USN-8781-1 |
| Ubuntu 24.04 LTS | linux-oracle | 6.8.0-1064.67 | USN-8917-1 |
| Ubuntu 24.04 LTS | linux-oracle-7.0 | 7.0.0-1013.13~24.04.1 | USN-8887-3 |
| Ubuntu 24.04 LTS | linux-raspi | 6.8.0-1068.72 | USN-9025-1 |
| Ubuntu 24.04 LTS | linux-riscv +29 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-riscv-7.0 | 7.0.0-38.38.1~24.04.1 | — |
| Ubuntu 24.04 LTS | linux-vmware | 6.8.0-1008.8 | — |
| Ubuntu 22.04 LTS | linux | 5.15.0-202.212 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-aws | 5.15.0-1119.126 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-aws-6.8 | 6.8.0-1069.74~22.04.1 | USN-9024-1 |
| Ubuntu 22.04 LTS | linux-azure | 5.15.0-1125.134 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-azure-6.8 | 6.8.0-1073.82~22.04.1 | USN-9026-1 |
| Ubuntu 22.04 LTS | linux-azure-fde | 5.15.0-1124.133 | USN-8962-1 |
| Ubuntu 22.04 LTS | linux-azure-fde-6.8 | 6.8.0-1071.78~22.04.1 | USN-9026-1 |
| Ubuntu 22.04 LTS | linux-gcp | 5.15.0-1120.130 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-gcp-6.8 | 6.8.0-1073.81~22.04.1 | USN-9024-1 |
| Ubuntu 22.04 LTS | linux-gke | 5.15.0-1115.121 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-gkeop | 5.15.0-1102.110 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-hwe-6.8 | 6.8.0-149.149~22.04.1 | USN-9066-1 |
| Ubuntu 22.04 LTS | linux-ibm | 5.15.0-1113.117 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-ibm-6.8 | 6.8.0-1069.70~22.04.1 | USN-9024-1 |
| Ubuntu 22.04 LTS | linux-intel-iotg | 5.15.0-1114.120 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-kvm | 5.15.0-1111.116 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-lowlatency | 5.15.0-197.207 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-lowlatency-hwe-6.8 | 6.8.0-149.149.1~22.04.1 | USN-9024-1 |
| Ubuntu 22.04 LTS | linux-nvidia | 5.15.0-1114.115 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-nvidia-tegra | 5.15.0-1070.72 | USN-8963-1 |
| Ubuntu 22.04 LTS | linux-nvidia-tegra-igx | 5.15.0-1059.59 | USN-8963-1 |
| Ubuntu 22.04 LTS | linux-oracle | 5.15.0-1116.122 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-oracle-6.8 | 6.8.0-1067.71~22.04.1 | USN-9025-1 |
| Ubuntu 22.04 LTS | linux-raspi | 5.15.0-1113.116 | USN-9029-1 |
| Ubuntu 22.04 LTS | linux-riscv +34 | No fix yet | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-raspi-realtime | 6.8.0-2056.58 | USN-9025-1 |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime | 6.8.1-1062.63 | USN-8917-1 |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.14 +1 | No fix yet | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-intel-iot-realtime | 5.15.0-1111.115 | USN-8961-1 |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime | 5.15.0-1118.127 | USN-8961-1 |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime-6.8 | 6.8.1-1064.65~22.04.1 | USN-9024-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-aws-fips | 6.8.0-1067.70+fips1 | USN-8917-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-fips | 6.8.0-147.147+fips1 | USN-8917-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-gcp-fips +1 | 6.8.0-1071.79+fips1 | USN-8918-1, USN-8917-1 |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-aws-fips | 5.15.0-1119.126+fips1 | USN-8961-1 |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-azure-fips | 5.15.0-1125.134+fips1 | USN-8961-1 |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-fips | 5.15.0-202.212+fips1 | USN-8961-1 |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-gcp-fips | 5.15.0-1120.130+fips1 | USN-8961-1 |
| Ubuntu Pro FIPS-preview 22.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | linux-aws-5.15 | 5.15.0-1119.126~20.04.1 | USN-8961-1 |
| Ubuntu Pro 20.04 LTS | linux-azure-5.15 | 5.15.0-1125.134~20.04.1 | USN-8961-1 |
| Ubuntu Pro 20.04 LTS | linux-azure-fde-5.15 | 5.15.0-1124.133~20.04.1 | USN-8961-1 |
| Ubuntu Pro 20.04 LTS | linux-gcp-5.15 | 5.15.0-1120.130~20.04.1 | USN-8961-1 |
| Ubuntu Pro 20.04 LTS | linux-hwe-5.15 | 5.15.0-202.212~20.04.1 | USN-8961-1 |
| Ubuntu Pro 20.04 LTS | linux-ibm-5.15 | 5.15.0-1113.117~20.04.1 | USN-8961-1 |
| Ubuntu Pro 20.04 LTS | linux-intel-iotg-5.15 | 5.15.0-1114.120~20.04.1 | USN-8961-1 |
| Ubuntu Pro 20.04 LTS | linux-lowlatency-hwe-5.15 | 5.15.0-197.207~20.04.1 | USN-8961-1 |
| Ubuntu Pro 20.04 LTS | linux-nvidia-tegra-5.15 | 5.15.0-1070.72~20.04.1 | USN-8963-1 |
| Ubuntu Pro 20.04 LTS | linux-oracle-5.15 | 5.15.0-1116.122~20.04.1 | USN-8961-1 |
| Ubuntu Pro 20.04 LTS | linux-riscv-5.15 | 5.15.0-1113.117~20.04.2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | rv +76 | 6.12.0-211.39.1.el10_2 | RHSA-2026:45114 |
| RHEL 9 | rv +75 | 5.14.0-687.30.1.el9_8 | RHSA-2026:45192 |
| RHEL 8 | kernel-rt +12 | 4.18.0-553.147.1.rt7.488.el8_10 | RHSA-2026:45116 |
| RHEL 8 | perf +26 | 4.18.0-553.147.1.el8_10 | RHSA-2026:45115 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | rv +77 | 6.12.0-55.94.1.el10_0 | RHSA-2026:49030 |
| RHEL 9.6 EUS | rv +77 | 5.14.0-570.131.1.el9_6 | RHSA-2026:49031 |
| RHEL 9.4 E4S | bpftool | 7.3.0-427.141.1.el9_4 | RHSA-2026:48386 |
| RHEL 9.4 E4S | rv +62 | 5.14.0-427.141.1.el9_4 | RHSA-2026:48386 |
| RHEL 8.8 TUS | perf +17 | 4.18.0-477.156.1.el8_8 | RHSA-2026:47869 |
| RHEL 8.8 E4S | perf +18 | 4.18.0-477.156.1.el8_8 | RHSA-2026:47869 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | rv +74 | 6.12.0-211.39.1.el10_2 | ALSA-2026:45114 |
| AlmaLinux 9 | rv +73 | 5.14.0-687.30.1.el9_8 | ALSA-2026:45192 |
| AlmaLinux 8 | kernel-rt +9 | 4.18.0-553.147.1.rt7.488.el8_10 | ALSA-2026:45116 |
| AlmaLinux 8 | perf +24 | 4.18.0-553.147.1.el8_10 | ALSA-2026:45115 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | kernel-64kb +7 | 6.4.0-150700.53.78.1 | SUSE-SU-2026:3790-1 |
| SLES 15 SP7 | kernel-default-base | 6.4.0-150700.53.78.1.150700.17.43.2 | SUSE-SU-2026:3790-1 |
| SLES 15 SP6 | kernel-64kb +6 | 6.4.0-150600.23.130.1 | SUSE-SU-2026:3602-1 |
| SLES 15 SP6 | kernel-default-base | 6.4.0-150600.23.130.1.150600.12.60.3 | SUSE-SU-2026:3602-1 |
| SLES 15 SP5 | kernel-64kb +6 | 5.14.21-150500.55.182.1 | SUSE-SU-2026:3595-1 |
| SLES 15 SP5 | kernel-default-base | 5.14.21-150500.55.182.1.150500.6.85.2 | SUSE-SU-2026:3595-1 |
| SLES 15 SP4 | kernel-64kb +6 | 5.14.21-150400.24.235.1 | SUSE-SU-2026:3593-1 |
| SLES 15 SP4 | kernel-default-base | 5.14.21-150400.24.235.1.150400.24.118.3 | SUSE-SU-2026:3593-1 |
Show 18 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | kernel-64kb +8 | 6.12.0-160000.37.1 | SUSE-SU-2026:23902-1, SUSE-SU-2026:23231-1, SUSE-SU-2026:23221-1 |
| SLES for SAP 16.0 | kernel-default-base | 6.12.0-160000.37.1.160000.2.19 | SUSE-SU-2026:23902-1, SUSE-SU-2026:23231-1, SUSE-SU-2026:23221-1 |
| SLES for SAP 16.0 | kernel-livepatch-SLE16_Update_0 | 18-160000.4.3 | SUSE-SU-2026:23936-1 |
| SLES for SAP 16.0 | kernel-livepatch-SLE16_Update_1 | 16-160000.1.1 | SUSE-SU-2026:23938-1 |
| SLES for SAP 16.0 | kernel-livepatch-SLE16_Update_14 | 5-160000.1.1 | SUSE-SU-2026:23790-1 |
| SLES for SAP 16.0 | kernel-livepatch-SLE16_Update_15 | 3-160000.1.1 | SUSE-SU-2026:23951-1 |
| SLES for SAP 16.0 | kernel-livepatch-SLE16_Update_2 | 14-160000.1.1 | SUSE-SU-2026:23939-1 |
| SLES for SAP 16.0 | kernel-livepatch-SLE16_Update_3 | 13-160000.1.1 | SUSE-SU-2026:23941-1 |
| SLES for SAP 16.0 | kernel-livepatch-SLE16_Update_4 | 12-160000.1.1 | SUSE-SU-2026:23942-1 |
| SLES for SAP 16.0 | kernel-livepatch-SLE16_Update_5 | 11-160000.1.1 | SUSE-SU-2026:23944-1 |
| SLES for SAP 16.0 | kernel-livepatch-SLE16_Update_8 | 8-160000.1.1 | SUSE-SU-2026:23791-1 |
| SLES for SAP 16.0 | kernel-livepatch-SLE16_Update_9 +1 | 7-160000.1.1 | SUSE-SU-2026:23940-1, SUSE-SU-2026:23937-1 |
| SLES for SAP 15 SP6 | kernel-default-base | 6.4.0-150600.23.130.1.150600.12.60.3 | SUSE-SU-2026:3602-1 |
| SLES for SAP 15 SP6 | kernel-docs +4 | 6.4.0-150600.23.130.1 | SUSE-SU-2026:3602-1 |
| SLES for SAP 15 SP5 | kernel-default-base | 5.14.21-150500.55.182.1.150500.6.85.2 | SUSE-SU-2026:3595-1 |
| SLES for SAP 15 SP5 | kernel-docs +4 | 5.14.21-150500.55.182.1 | SUSE-SU-2026:3595-1 |
| SLES for SAP 15 SP4 | kernel-default-base | 5.14.21-150400.24.235.1.150400.24.118.3 | SUSE-SU-2026:3593-1 |
| SLES for SAP 15 SP4 | kernel-docs +4 | 5.14.21-150400.24.235.1 | SUSE-SU-2026:3593-1 |
| SLES 16.0 | kernel-64kb +8 | 6.12.0-160000.37.1 | SUSE-SU-2026:23902-1, SUSE-SU-2026:23897-1, SUSE-SU-2026:23237-1 |
| SLES 16.0 | kernel-default-base | 6.12.0-160000.37.1.160000.2.19 | SUSE-SU-2026:23902-1, SUSE-SU-2026:23231-1, SUSE-SU-2026:23221-1 |
| SLES 16.0 | kernel-livepatch-SLE16_Update_0 | 18-160000.4.3 | SUSE-SU-2026:23936-1 |
| SLES 16.0 | kernel-livepatch-SLE16_Update_1 | 16-160000.1.1 | SUSE-SU-2026:23938-1 |
| SLES 16.0 | kernel-livepatch-SLE16_Update_14 | 5-160000.1.1 | SUSE-SU-2026:23790-1 |
| SLES 16.0 | kernel-livepatch-SLE16_Update_15 | 3-160000.1.1 | SUSE-SU-2026:23951-1 |
| SLES 16.0 | kernel-livepatch-SLE16_Update_2 | 14-160000.1.1 | SUSE-SU-2026:23939-1 |
| SLES 16.0 | kernel-livepatch-SLE16_Update_3 | 13-160000.1.1 | SUSE-SU-2026:23941-1 |
| SLES 16.0 | kernel-livepatch-SLE16_Update_4 | 12-160000.1.1 | SUSE-SU-2026:23942-1 |
| SLES 16.0 | kernel-livepatch-SLE16_Update_5 | 11-160000.1.1 | SUSE-SU-2026:23944-1 |
| SLES 16.0 | kernel-livepatch-SLE16_Update_8 | 8-160000.1.1 | SUSE-SU-2026:23791-1 |
| SLES 16.0 | kernel-livepatch-SLE16_Update_9 +1 | 7-160000.1.1 | SUSE-SU-2026:23940-1, SUSE-SU-2026:23937-1 |
| SLE Micro 6.2 | kernel-default-base | 6.12.0-160000.37.1.160000.2.19 | SUSE-SU-2026:23887-1, SUSE-SU-2026:23068-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16-RT_Update_0 | 16-160000.3.4 | SUSE-SU-2026:23676-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16-RT_Update_1 | 15-160000.1.1 | SUSE-SU-2026:23677-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16-RT_Update_7 | 9-160000.1.1 | SUSE-SU-2026:23682-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16_Update_0 | 18-160000.4.3 | SUSE-SU-2026:23960-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16_Update_1 | 16-160000.1.1 | SUSE-SU-2026:23961-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16_Update_14 +3 | 5-160000.1.1 | SUSE-SU-2026:23798-1, SUSE-SU-2026:23674-1, SUSE-SU-2026:23673-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16_Update_15 | 3-160000.1.1 | SUSE-SU-2026:23968-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16_Update_2 | 14-160000.1.1 | SUSE-SU-2026:23963-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16_Update_3 +1 | 13-160000.1.1 | SUSE-SU-2026:23965-1, SUSE-SU-2026:23678-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16_Update_4 +2 | 12-160000.1.1 | SUSE-SU-2026:23966-1, SUSE-SU-2026:23687-1, SUSE-SU-2026:23679-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16_Update_5 +1 | 11-160000.1.1 | SUSE-SU-2026:23967-1, SUSE-SU-2026:23680-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16_Update_6 +1 | 10-160000.1.1 | SUSE-SU-2026:23801-1, SUSE-SU-2026:23681-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16_Update_8 +1 | 8-160000.1.1 | SUSE-SU-2026:23799-1, SUSE-SU-2026:23683-1 |
| SLE Micro 6.2 | kernel-livepatch-SLE16_Update_9 +4 | 7-160000.1.1 | SUSE-SU-2026:23964-1, SUSE-SU-2026:23962-1, SUSE-SU-2026:23686-1 |
| SLE Micro 6.2 | kernel-rt +5 | 6.12.0-160000.37.1 | SUSE-SU-2026:23887-1, SUSE-SU-2026:23881-1, SUSE-SU-2026:23068-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0-RT_Update_13 +1 | 12-1.1 | SUSE-SU-2026:23781-1, SUSE-SU-2026:23780-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0-RT_Update_22 | 6-1.2 | SUSE-SU-2026:23771-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_10 +1 | 17-1.1 | SUSE-SU-2026:23778-1, SUSE-SU-2026:23747-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_11 +2 | 16-1.1 | SUSE-SU-2026:23779-1, SUSE-SU-2026:23749-1, SUSE-SU-2026:23748-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_13 | 14-1.1 | SUSE-SU-2026:23750-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_14 | 12-1.2 | SUSE-SU-2026:23751-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_16 +1 | 11-1.1 | SUSE-SU-2026:23766-1, SUSE-SU-2026:23752-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_17 +1 | 10-1.1 | SUSE-SU-2026:23767-1, SUSE-SU-2026:23753-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_18 +1 | 9-1.1 | SUSE-SU-2026:23768-1, SUSE-SU-2026:23754-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_19 +1 | 7-1.1 | SUSE-SU-2026:23769-1, SUSE-SU-2026:23755-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_20 +5 | 6-1.1 | SUSE-SU-2026:23772-1, SUSE-SU-2026:23770-1, SUSE-SU-2026:23760-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_24 +1 | 5-1.1 | SUSE-SU-2026:23773-1, SUSE-SU-2026:23759-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_25 +1 | 4-1.1 | SUSE-SU-2026:23774-1, SUSE-SU-2026:23761-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_26 +3 | 3-1.1 | SUSE-SU-2026:23776-1, SUSE-SU-2026:23775-1, SUSE-SU-2026:23763-1 |
| SLE Micro 6.1 | kernel-rt +4 | 6.4.0-51.1 | SUSE-SU-2026:23194-1, SUSE-SU-2026:23193-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0-RT_Update_13 +1 | 12-1.1 | SUSE-SU-2026:23835-1, SUSE-SU-2026:23834-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0-RT_Update_22 | 6-1.2 | SUSE-SU-2026:23808-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_10 +1 | 17-1.1 | SUSE-SU-2026:23832-1, SUSE-SU-2026:23815-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_11 +2 | 16-1.1 | SUSE-SU-2026:23833-1, SUSE-SU-2026:23817-1, SUSE-SU-2026:23816-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_13 | 14-1.1 | SUSE-SU-2026:23818-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_14 | 12-1.2 | SUSE-SU-2026:23819-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_16 +1 | 11-1.1 | SUSE-SU-2026:23820-1, SUSE-SU-2026:23803-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_17 +1 | 10-1.1 | SUSE-SU-2026:23821-1, SUSE-SU-2026:23804-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_18 +1 | 9-1.1 | SUSE-SU-2026:23822-1, SUSE-SU-2026:23805-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_19 +1 | 7-1.1 | SUSE-SU-2026:23823-1, SUSE-SU-2026:23806-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_20 +5 | 6-1.1 | SUSE-SU-2026:23827-1, SUSE-SU-2026:23826-1, SUSE-SU-2026:23825-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_24 +1 | 5-1.1 | SUSE-SU-2026:23828-1, SUSE-SU-2026:23810-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_25 +1 | 4-1.1 | SUSE-SU-2026:23836-1, SUSE-SU-2026:23811-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_26 +3 | 3-1.1 | SUSE-SU-2026:23838-1, SUSE-SU-2026:23837-1, SUSE-SU-2026:23813-1 |
| SLE Micro 6.0 | kernel-rt +4 | 6.4.0-51.1 | SUSE-SU-2026:23244-1, SUSE-SU-2026:23241-1 |
| SLE Micro 5.5 | kernel-default-base | 5.14.21-150500.55.182.1.150500.6.85.2 | SUSE-SU-2026:3595-1 |
| SLE Micro 5.5 | kernel-rt +1 | 5.14.21-150500.13.156.1 | SUSE-SU-2026:3617-1 |
| SLE Micro 5.5 | kernel-source +1 | 5.14.21-150500.55.182.1 | SUSE-SU-2026:3595-1 |
| SLE Micro 5.4 | kernel-default-base | 5.14.21-150400.24.235.1.150400.24.118.3 | SUSE-SU-2026:3593-1 |
| SLE Micro 5.4 | kernel-rt +1 | 5.14.21-150400.15.181.1 | SUSE-SU-2026:3616-1 |
| SLE Micro 5.4 | kernel-source +1 | 5.14.21-150400.24.235.1 | SUSE-SU-2026:3593-1 |
| SLE Micro 5.3 | kernel-default-base | 5.14.21-150400.24.235.1.150400.24.118.3 | SUSE-SU-2026:3593-1 |
| SLE Micro 5.3 | kernel-rt +1 | 5.14.21-150400.15.181.1 | SUSE-SU-2026:3616-1 |
| SLE Micro 5.3 | kernel-source +1 | 5.14.21-150400.24.235.1 | SUSE-SU-2026:3593-1 |
| SLE Live Patching 15 SP7 | kernel-default | 6.4.0-150700.53.78.1 | SUSE-SU-2026:3790-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7-RT_Update_18 | 2-150700.2.1 | SUSE-SU-2026:4172-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7-RT_Update_19 | 1-150700.1.5.1 | SUSE-SU-2026:3810-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_13 | 7-150700.2.1 | SUSE-SU-2026:4258-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_14 | 6-150700.2.1 | SUSE-SU-2026:4356-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_17 +2 | 4-150700.2.1 | SUSE-SU-2026:4359-1, SUSE-SU-2026:4357-1, SUSE-SU-2026:4170-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_19 | 3-150700.2.1 | SUSE-SU-2026:4383-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_20 | 1-150700.15.3.2 | SUSE-SU-2026:3790-1 |
| SLE Live Patching 15 SP6 | kernel-default | 6.4.0-150600.23.130.1 | SUSE-SU-2026:3602-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_16 | 14-150600.2.1 | SUSE-SU-2026:4231-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_30 | 1-150600.13.5.1 | SUSE-SU-2026:3602-1 |
| SLE Live Patching 15 SP5 | kernel-default | 5.14.21-150500.55.182.1 | SUSE-SU-2026:3595-1 |
| SLE Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_30 | 18-150500.2.1 | SUSE-SU-2026:4256-1 |
| SLE Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_39 | 7-150500.2.1 | SUSE-SU-2026:4244-1 |
| SLE Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_41 | 5-150500.2.1 | SUSE-SU-2026:4315-1 |
| SLE Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_44 | 1-150500.11.5.1 | SUSE-SU-2026:3595-1 |
| SLE Live Patching 15 SP4 | kernel-default | 5.14.21-150400.24.235.1 | SUSE-SU-2026:3593-1 |
| SLE Live Patching 15 SP4 | kernel-livepatch-SLE15-SP4_Update_55 +1 | 5-150400.2.1 | SUSE-SU-2026:4259-1, SUSE-SU-2026:4256-1 |
| SLE Live Patching 15 SP4 | kernel-livepatch-SLE15-SP4_Update_57 | 3-150400.2.1 | SUSE-SU-2026:4255-1 |
| SLE Live Patching 15 SP4 | kernel-livepatch-SLE15-SP4_Update_58 | 1-150400.9.7.1 | SUSE-SU-2026:3593-1 |
| SLE HPC 15 SP5 | kernel-64kb +5 | 5.14.21-150500.55.182.1 | SUSE-SU-2026:3595-1 |
| SLE HPC 15 SP5 | kernel-default-base | 5.14.21-150500.55.182.1.150500.6.85.2 | SUSE-SU-2026:3595-1 |
| SLE HPC 15 SP4 | kernel-64kb +5 | 5.14.21-150400.24.235.1 | SUSE-SU-2026:3593-1 |
| SLE HPC 15 SP4 | kernel-default-base | 5.14.21-150400.24.235.1.150400.24.118.3 | SUSE-SU-2026:3593-1 |
| SUSE Real Time Module 15 SP7 | kernel-rt +2 | 6.4.0-150700.7.72.1 | SUSE-SU-2026:3810-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kernel-source | 7.1.7-1.1 | openSUSE-SU-2026:11476-1 |
| openSUSE Leap 16.0 | kernel-default-base | 6.12.0-160000.37.1.160000.2.19 | openSUSE-SU-2026:21910-1, openSUSE-SU-2026:21555-1 |
| openSUSE Leap 16.0 | kernel-rt +11 | 6.12.0-160000.37.1 | openSUSE-SU-2026:21910-1, openSUSE-SU-2026:21555-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kernel-livepatch-6.18.41-94.142 +2 | 1:1.0-0.amzn2023 | ALAS2023-2026-2071, ALAS2023-2026-2058, ALAS2023-2026-2057 |
| Amazon Linux 2023 | perf +11 | 1:6.1.180-225.360.amzn2023 | ALAS2023-2026-2058 |
| Amazon Linux 2023 | perf6.12 +11 | 1:6.12.100-125.179.amzn2023 | ALAS2023-2026-2057 |
| Amazon Linux 2023 | perf6.18 +12 | 1:6.18.41-94.142.amzn2023 | ALAS2023-2026-2071 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kernel | 6.6.150.1-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | bpftool +1 | 5.15.0-322.203.3.5.el9uek | ELSA-2026-500248, ELSA-2026-500150, ELSA-2026-500137 |
| Oracle Linux 9 | kernel-uek64k +33 | 6.12.0-204.92.4.4.3.el10uek | ELSA-2026-500248, ELSA-2026-500150, ELSA-2026-500135 |
| Oracle Linux 8 | bpftool +18 | 5.15.0-322.203.3.5.el9uek | ELSA-2026-500249, ELSA-2026-500162 |
| Oracle Linux 7 | kernel-uek | 5.4.17-2136.358.2.1.el8uek | ELSA-2026-500136 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 7 repositories
-
HORKimhab/CVE-2026-64561 ★ 3 · Aug 7, 2026
CVE-2026-64561
-
HackSpeak/CVE-2026-64561 ★ 2 · Aug 8, 2026
Zapscape (CVE-2026-64561) KVM/x86 shadow MMU UAF guest-to-host escape PoC mirror — V4bel/@v4bel, MIT; for authorized security testing
-
aarif450/Zapscape ★ 2 · Aug 7, 2026
Guest-to-host KVM/x86 escape exploiting CVE-2026-64561, delivering a full PoC chain and analysis for security researchers.
-
Aoripus-LTD/Zapscape-Fix ★ 1 · Aug 7, 2026
Generic kernel live patch for the KVM/x86 shadow-MMU use-after-free (Zapscape, CVE-2026-64561)
-
chuzhongyun/CVE-2026-64561-Kernel-Fix ★ 0 · Aug 8, 2026
Linux 内核升级指南 - 修复 CVE-2026-64561
-
suominen/zapscape ★ 0 · Aug 7, 2026
Tracking Zapscape (CVE-2026-64561), the KVM/x86 shadow-MMU guest-to-host escape
-
aarif450/aarif450.github.io ★ 0 · Aug 7, 2026
Exploit KVM/x86 guest-to-host escape CVE-2026-64561 with Zapscape, a proof-of-concept demonstrating hypervisor vulnerability.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 50
- USN-8961-1 linux, linux-aws, linux-aws-5.15, linux-aws-fips, linux-azure, linux-azure-5.15, linux-azure-fde-5.15, linux-azure-fips, linux-fips, linux-gcp, linux-gcp-5.15, linux-gcp-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iot-realtime, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8917-1 linux, linux-aws, linux-aws-fips, linux-fips, linux-gcp, linux-gcp-fips, linux-gke, linux-gkeop, linux-ibm, linux-lowlatency, linux-oracle, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8963-1 linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9025-1 linux-oracle-6.8, linux-raspi, linux-raspi-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9024-1 linux-aws-6.8, linux-gcp-6.8, linux-ibm-6.8, linux-lowlatency-hwe-6.8, linux-nvidia, linux-realtime-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8887-1 linux, linux-aws, linux-gcp, linux-gke, linux-ibm, linux-oracle, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9026-1 linux-azure-6.8, linux-azure-fde-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9021-1 linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9029-1 linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9040-1 linux-nvidia-lowlatency vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9066-1 linux-hwe-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8918-1 linux-azure, linux-azure-fde, linux-azure-fips vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8888-2 linux-azure-7.0, linux-azure-fde-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9003-1 linux-nvidia-7.0, linux-nvidia-bos vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8889-1 linux-oem-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9043-1 linux-nvidia vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8887-3 linux-gcp-7.0, linux-hwe-7.0, linux-oracle-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8888-1 linux-azure, linux-azure-fde vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8962-1 linux-azure-fde vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8887-2 linux-aws-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- RHSA-2026:49030 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:48386 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:49031 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:47869 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-2640 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- USN-8781-1 linux-nvidia-tegra vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- ALSA-2026:45192 Important: kernel security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:45114 Important: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:45116 Important: kernel-rt security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:45115 Important: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:45116 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:45192 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:45115 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:45114 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- SUSE-SU-2026:3602-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 2, 2026
- SUSE-SU-2026:23964-1 Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise 16) SUSE / openSUSE Security Updates · Oct 2, 2026
- SUSE-SU-2026:23968-1 Security update for the Linux Kernel (Live Patch 15 for SUSE Linux Enterprise 16) SUSE / openSUSE Security Updates · Oct 2, 2026
- SUSE-SU-2026:23962-1 Security update for the Linux Kernel (Live Patch 9 for SUSE Linux Enterprise 16) SUSE / openSUSE Security Updates · Oct 2, 2026
- SUSE-SU-2026:23963-1 Security update for the Linux Kernel (Live Patch 2 for SUSE Linux Enterprise 16) SUSE / openSUSE Security Updates · Oct 2, 2026
- SUSE-SU-2026:23966-1 Security update for the Linux Kernel (Live Patch 4 for SUSE Linux Enterprise 16) SUSE / openSUSE Security Updates · Oct 2, 2026
- SUSE-SU-2026:23967-1 Security update for the Linux Kernel (Live Patch 5 for SUSE Linux Enterprise 16) SUSE / openSUSE Security Updates · Oct 2, 2026
- SUSE-SU-2026:23960-1 Security update for the Linux Kernel (Live Patch 0 for SUSE Linux Enterprise 16) SUSE / openSUSE Security Updates · Oct 2, 2026
- SUSE-SU-2026:23961-1 Security update for the Linux Kernel (Live Patch 1 for SUSE Linux Enterprise 16) SUSE / openSUSE Security Updates · Oct 2, 2026
- SUSE-SU-2026:23944-1 Security update for the Linux Kernel (Live Patch 5 for SUSE Linux Enterprise 16) SUSE / openSUSE Security Updates · Oct 2, 2026
- SUSE-SU-2026:23951-1 Security update for the Linux Kernel (Live Patch 15 for SUSE Linux Enterprise 16) SUSE / openSUSE Security Updates · Oct 2, 2026
- SUSE-SU-2026:23937-1 Security update for the Linux Kernel (Live Patch 9 for SUSE Linux Enterprise 16) SUSE / openSUSE Security Updates · Oct 2, 2026
- SUSE-SU-2026:23938-1 Security update for the Linux Kernel (Live Patch 1 for SUSE Linux Enterprise 16) SUSE / openSUSE Security Updates · Oct 2, 2026
- SUSE-SU-2026:23939-1 Security update for the Linux Kernel (Live Patch 2 for SUSE Linux Enterprise 16) SUSE / openSUSE Security Updates · Oct 2, 2026
- SUSE-SU-2026:23940-1 Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise 16) SUSE / openSUSE Security Updates · Oct 2, 2026
- SUSE-SU-2026:23941-1 Security update for the Linux Kernel (Live Patch 3 for SUSE Linux Enterprise 16) SUSE / openSUSE Security Updates · Oct 2, 2026
References
- https://git.kernel.org/stable/c/62ef67af1878fa2cd066642f2f59e33ade95f637
- https://git.kernel.org/stable/c/65c4f7a1028cf01a93a2762d679c289810ede990
- https://git.kernel.org/stable/c/35e77467610c4a37cb0ff54ee56b85f73b1f5700
- https://git.kernel.org/stable/c/0026dbb7de8ea76e97d6edf42fc3cc084564e2bf
- https://git.kernel.org/stable/c/f3477a6a4164f15287444eda685b5f6405dbd1e5
- https://git.kernel.org/stable/c/bce0d3c26e2c761a4bf43c8949f333fc7374eb2d
- https://git.kernel.org/stable/c/2abd5287f08319fa35764566b15c6e22cb1068db
- https://github.com/V4bel/Zapscape