CVE-2026-23401: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23401 is a denial-of-service vulnerability in the Linux kernel's KVM x86/MMU subsystem caused by a failure to drop or zap an existing shadow-present SPTE (Shadow Page Table Entry) before installing an emulated MMIO SPTE. The flaw affects Linux kernel versions 5.13.1 through 5.15.202, 5.16 through 6.1.167, 6.2 through 6.6.130, 6.7 through 6.12.79, 6.13 through 6.18.20, 6.19 through 6.19.10, and multiple 7.0 release candidates. It was published on April 1, 2026, with patches added to stable branches by April 24, 2026. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is an improper state transition in the KVM MMU's SPTE management logic: when host userspace modifies a shadowed guest page table entry (gPTE) to redirect from a memslot to emulated MMIO outside of KVM's normal code path, and the guest subsequently triggers a page fault, mmu_set_spte() calls mark_mmio_spte() without first zapping the existing shadow-present SPTE. This violates an internal kernel assertion (is_shadow_present_pte(*sptep)), triggering a kernel WARNING at arch/x86/kvm/mmu/mmu.c:484. The flaw is reachable locally by a low-privileged user with access to KVM virtualization (e.g., a process managing a VM), and the call trace runs through ept_page_fault → kvm_mmu_do_page_fault → kvm_mmu_page_fault → vmx_handle_exit. No CWE classification has been formally assigned (GitHub Advisory).

Exploitation of this vulnerability results in kernel WARNING messages and potential system instability in KVM-based virtualized environments, with an availability impact rated High. There is no confidentiality or integrity impact — the vulnerability cannot be used to access or modify data. The scope is limited to the affected host system's KVM subsystem, and lateral movement or data exfiltration are not applicable to this flaw (GitHub Advisory).

• Logs: Kernel log entries containing WARNING: arch/x86/kvm/mmu/mmu.c:484 or is_shadow_present_pte(*sptep) at mark_mmio_spte.
• Process: Unusual KVM-related process activity (e.g., vmx_ept_stale_r) triggering repeated page faults visible in kernel tracing or dmesg.
• Logs: Call traces in dmesg or /var/log/kern.log referencing mmu_set_spte, ept_page_fault, kvm_mmu_do_page_fault, or vmx_handle_exit in the KVM module stack.

Apply the upstream kernel patches available across all affected stable branches: upgrade to 5.15.203+, 6.1.168+, 6.6.131+, 6.12.80+, 6.18.21+, or 6.19.11+ as appropriate for your kernel series. Vendor-specific updates are available from Red Hat (RHSA-2026:13577, RHSA-2026:13578, and subsequent advisories), AlmaLinux (ALSA-2026-13577, ALSA-2026-13578), Amazon Linux 2023 (ALAS2023-2026-1646), and Debian (linux 6.19.11+1). As a temporary workaround where patching is not immediately possible, restrict host-level access to processes that can modify guest memory and page tables outside of KVM's control (GitHub Advisory, Red Hat Advisory).