CVE-2026-64561: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64561 is a memory management vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem, specifically in the x86 MMU page fault handling logic. The flaw causes KVM to check for an invalid or obsolete root before making MMU pages available, allowing a race condition where shadow page reclamation can mark an in-use root invalid, after which KVM proceeds to map memory into that invalid root. Affected versions span Linux kernel 5.9 through unpatched releases of the 6.6, 6.12, 6.18, and 7.1 stable series. It was published on August 4, 2026, with patches available the same day. The vulnerability carries a CVSS v3.1 base score of 7.0 (High) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-825 (Expired Pointer Dereference): when the shadow MMU reclaims pages and zaps an in-use root (marking it invalid), KVM does not re-validate the root's state before proceeding to map memory into it. Child shadow pages created during this map/fetch operation inherit their parent's role.invalid flag, placing invalid pages onto the list of active MMU pages — a direct violation of KVM's internal invariant established in Linux 5.9 (2020). The underlying ordering flaw has existed since commit 2e53d63acba7 in 2008, but the invariant that makes it dangerous was introduced with Linux 5.9. Exploitation requires local access and the ability to trigger memory pressure or page faults within a KVM VM, making the attack complexity high (GitHub Advisory, Red Hat).

Successful exploitation can result in kernel memory corruption, system crashes (kernel panic), or potential privilege escalation for a local user with sufficient access to KVM virtual machine configurations. Because invalid shadow pages are placed on the active MMU pages list, kernel memory management assumptions are broken, which can affect the confidentiality, integrity, and availability of the host system. The impact is confined to the local host (scope unchanged), but a compromised hypervisor host could indirectly affect all guest VMs running on it (GitHub Advisory, Red Hat).

Patches have been released for all affected stable kernel branches: upgrade to Linux 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5 (or later) to remediate the vulnerability (GitHub Advisory). As a temporary workaround, administrators should limit memory pressure scenarios on KVM hosts, restrict access to KVM VM configurations that could trigger aggressive page reclamation, and monitor for unexpected kernel panics. Red Hat has also tracked this issue and users of RHEL-based distributions should apply vendor-provided kernel updates as they become available (Red Hat).

Red Hat has acknowledged the vulnerability and is tracking it via Bugzilla (bug ID 2510891), with a CVSS score assigned on August 4, 2026 (Red Hat). No notable independent researcher commentary or significant social media discussion has been identified beyond standard CVE tracking aggregators.