CVE-2026-23215: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23215 is a register-clobbering vulnerability in the Linux kernel's x86/VMware hypercall handling mechanism, specifically within the vmmouse driver. When running on QEMU with VMware mouse emulation enabled, the QEMU vmmouse driver saves and restores register state using a uint32_t data[6] array, which clears the top 32 bits of 64-bit registers (notably %rdi) after a hypercall. This causes the kernel to dereference a corrupted pointer, resulting in a kernel panic. Affected kernel versions include 6.11 through 6.12.69 and 6.13 through 6.18.9. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper handling of register state across VMware hypercalls in the Linux kernel's vmmouse driver (CWE-119/CWE-664 — improper resource management). The QEMU VMware mouse emulation stores register context in a uint32_t data[6] structure, which truncates 64-bit register values to 32 bits upon restoration. When vmware_hypercall3() or vmware_hypercall4() is invoked during vmmouse_report_events(), the %rdi register — which holds a valid kernel stack pointer (e.g., 0xff5eeb3240003e54) — is corrupted to its lower 32-bit value (0x40003e54), causing a subsequent page fault on dereference. The kernel-side fix marks %rdi and %rsi as clobbered in the inline assembly for those two hypercall variants, preventing the compiler from keeping live values in those registers across the call (Red Hat Bugzilla).

Successful exploitation results in a kernel panic (BUG: unable to handle page fault), causing a denial of service on the affected system. The vulnerability has no confidentiality or integrity impact — only availability is affected, as the crash occurs at the supervisor level during a vmmouse_report_events call. Systems running on QEMU with VMware mouse emulation enabled and kernel versions 6.11–6.12.69 or 6.13–6.18.9 are at risk; bare-metal or non-QEMU VMware environments are not affected (Red Hat Advisory, Red Hat Bugzilla).

• Logs: Kernel logs (dmesg, /var/log/kern.log) showing BUG: unable to handle page fault for address: 0000000040003e54 with #PF: supervisor write access in kernel mode.
• Logs: Stack traces referencing vmware_hypercall4.constprop.0, vmmouse_report_events, psmouse_handle_byte, and ps2_interrupt in kernel crash output.
• System: Unexpected system reboots or kernel panics on QEMU-hosted VMs with VMware mouse emulation enabled.
• Process: Kernel oops or panic events triggered during mouse input activity on affected QEMU VMs (Red Hat Bugzilla).

Update the Linux kernel to version 6.12.70 or later (for systems on the 6.11–6.12.x branch) or 6.18.10 or later (for systems on the 6.13–6.18.x branch). Patches are available via stable kernel commits on git.kernel.org. As a workaround, disabling the vmmouse kernel driver eliminates the attack vector entirely for systems that do not require VMware mouse emulation. Systems not running QEMU with VMware mouse emulation are not affected and require no action (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability was initially reported by Fedora QA, who observed the kernel panic in a QEMU-based test environment. Red Hat tracked the issue via Bugzilla and noted the upstream kernel advisory from Greg Kroah-Hartman on the linux-cve-announce mailing list. Downstream distributions including Debian, Ubuntu, Oracle Linux, SUSE, and openSUSE have issued their own kernel update advisories addressing this CVE (Red Hat Bugzilla, Red Hat Advisory).