CVE-2026-23402: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23402 is a vulnerability in the Linux kernel's KVM x86/mmu subsystem where an improper sanity check allows host userspace writes to bypass KVM's write tracking and corrupt shadow page table entries (SPTEs). The flaw exists because KVM's check against overwriting a shadow-present SPTE with a different target PFN was incorrectly applied to all MMU types, including non-direct MMUs (those with shadowed guest page tables), rather than only to direct MMUs. Affected kernel versions include 6.16 through 6.18.20, 6.19 through 6.19.10, and 7.0-rc1 through 7.0-rc7. It was published on April 1, 2026, with patches available by April 24, 2026. The CVSS v3.1 base score is 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-501 (Trust Boundary Violation): KVM's mmu_set_spte() function in arch/x86/kvm/mmu/mmu.c performs a sanity check (pfn != spte_to_pfn(*sptep)) that fires a kernel WARNING when a shadow-present SPTE is overwritten with a different target PFN. This check was applied universally, but writes from host userspace — outside KVM's scope — are not tracked by KVM's write-tracking mechanism and can legitimately cause this condition in shadow paging (non-direct MMU) scenarios. The fix restricts the WARN to direct MMUs only, where such overwrites are genuinely invalid. The vulnerability is triggered locally by a low-privileged host user interacting with a KVM virtual machine, as demonstrated by the vmx_ept_stale_r test case in the kernel call trace (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation by a local, low-privileged attacker on the host can trigger kernel warnings and cause system instability, potentially leading to denial of service via kernel panics or system crashes. There is no confidentiality or integrity impact — the vulnerability's primary consequence is high availability impact to the host system running KVM-based virtual machines. Virtualization infrastructure running affected kernel versions is at risk, and a crash of the host kernel could affect all guest VMs running on that host (GitHub Advisory, Red Hat Bugzilla).

• Logs: Kernel log entries containing pfn != spte_to_pfn(*sptep) WARNING from arch/x86/kvm/mmu/mmu.c:3069; kernel call traces involving mmu_set_spte, ept_page_fault, kvm_mmu_do_page_fault, and kvm_mmu_page_fault in dmesg or /var/log/kern.log.
• Process: Unusual processes invoking KVM ioctls (kvm_vcpu_ioctl) from low-privileged user accounts on the host; processes named or resembling vmx_ept_stale_r interacting with /dev/kvm.
• System: Unexpected kernel panics or system instability on hosts running KVM with shadow paging enabled on affected kernel versions (6.16–6.18.20, 6.19–6.19.10, 7.0-rc1 through rc7).

Update the Linux kernel to version 6.18.21 or later, 6.19.11 or later, or any stable release of 7.0 or newer, which include the fix across three upstream commits: a1e0f7150639, bab090e8fd56, and df83746075778 (GitHub Advisory). Debian has accepted the fix in linux 6.19.11-1 for unstable and as a stable backport. As a temporary workaround until patching is possible, restrict host-level userspace access to KVM memory regions and limit which users can interact with /dev/kvm. Systems not using KVM shadow paging (non-direct MMUs) are most directly affected, but all systems on vulnerable kernel versions should be patched.

Red Hat triaged the vulnerability as low severity/priority in their Bugzilla tracker, with the upstream kernel CVE announcement referenced by Mauro Matteo Cascella (Red Hat Bugzilla). The Yocto Project security mailing list discussed the CVE across multiple messages in the context of embedded Linux security tracking. Debian packaged the fix promptly in linux 6.19.11-1 for both unstable and stable-backports. No significant social media controversy or notable researcher commentary beyond standard vulnerability tracking has been observed.