CVE-2026-43045: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-43045 is a memory corruption and page reference leak vulnerability in the Linux kernel's mshv (Microsoft Hypervisor) component, specifically in the mshv_region_pin function. The flaw was published on May 1, 2026, and affects Linux kernel versions 6.15 through 6.19.11 and 7.0-rc1 through 7.0-rc4. It carries a CVSS v3.1 base score of 5.5 (Medium), requiring local access and low privileges to exploit (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper error handling (CWE-390: Detection of Error Condition Without Action) in the mshv_region_pin function. Two distinct flaws exist: first, pin_user_pages_fast() can return a short pin count (fewer pages than requested but greater than zero), which the code incorrectly treats as success, causing partially pinned memory regions to be used and resulting in memory corruption. Second, when an error occurs mid-loop during page pinning, already-pinned pages from the current batch are not properly accounted for before mshv_region_invalidate_pages() is called, leading to a page reference leak. The fix treats short pin counts as errors and corrects partial batch accounting prior to cleanup (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation can lead to memory corruption through the use of partially pinned memory regions, as well as page reference leaks that cause resource exhaustion. The primary impact is on availability — affected systems running the mshv kernel component may experience system instability, crashes, or denial of service conditions. There is no confidentiality or integrity impact identified (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018–0.019%, placing it in the 6th percentile for exploitation likelihood within 30 days (GitHub Advisory). Exploitation requires local access with low privileges, limiting the attack surface to users or processes with local system access on affected kernel versions.

Patches are available in Linux kernel versions 6.19.12 and 7.0 (stable). The fixes are tracked in upstream commits a7d149152bc5a9119854331c57be35ad31fdf5cc and c0e296f257671ba10249630fe58026f29e4804d9. Administrators should update to a patched kernel version as soon as possible, prioritizing systems that use the mshv component (Microsoft Hypervisor integration). Monitor system memory usage and stability as an interim measure while patching is underway (GitHub Advisory, Red Hat Bugzilla).

Red Hat has tracked this vulnerability via its Bugzilla system and the upstream kernel CVE announcement mailing list. No significant public researcher commentary or media coverage has been identified beyond standard vulnerability tracking and scanner detection (Qualys, Nessus) (Red Hat Bugzilla).