CVE-2026-99082: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-99082 is a Linux kernel vulnerability in the KVM x86 subsystem involving incorrect MMIO cache validation when a vCPU operates in System Management Mode (SMM). The flaw causes the per-vCPU MMIO cache to use the wrong address space (always address space 0 instead of the active SMM address space 1), allowing stale cache entries to persist after SMM memslot updates. Affected versions span from Linux kernel 4.2 through unpatched releases prior to 6.6.160, 6.12.114, 6.18.58, 7.2.12, and 7.3. The vulnerability was published on October 23, 2026, with a CVSS category estimate of Medium (GitHub Advisory, Feedly).

The root cause is an incorrect use of kvm_memslots() in both the fill and validation paths of the per-vCPU MMIO cache, which unconditionally selects address space 0 even when the vCPU is running in SMM and should use address space 1. This was introduced when commit 699023e23965 added the SMM address space but did not update the MMIO cache helpers to use kvm_vcpu_memslots() (the active memslot accessor). When SMM memslots are updated, stale MMIO cache entries from the old SMM address space remain apparently valid; upon returning to the normal address space, a guest can trigger a GFN access that is incorrectly surfaced to userspace as KVM_EXIT_MMIO. The VMM then writes the backing page outside KVM's write-tracking path, potentially corrupting nested EPT tables and causing KVM to use stale shadow translations — triggering a WARN_ON_ONCE() in kvm_mmu_write_protect_fault(). No CWE classification has been formally assigned (GitHub Advisory).

A malicious guest operating system can exploit this vulnerability to corrupt nested EPT (Extended Page Tables) structures by writing to backing pages without going through KVM's write-tracking path, potentially leading to arbitrary code execution with hypervisor privileges. The integrity of the hypervisor's memory management is compromised, and the availability of the virtualization environment may be disrupted. The attack is local in nature, requiring the ability to run code within a guest VM, but the impact extends to the host hypervisor and potentially other co-hosted guests (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the publication date (Feedly). The vulnerability requires local access within a guest VM and the ability to manipulate SMM memslots and memory accesses, which limits the attack surface. No EPSS score or CISA KEV catalog entry has been reported for this CVE. The attack type is classified as local code execution (Feedly).

1. Gain guest OS access: Obtain code execution within a guest VM running on a vulnerable Linux KVM host (kernel version 4.2 through the unpatched versions).
2. Enter SMM: Trigger System Management Mode (SMM) within the guest, causing the vCPU to switch to address space 1 (SMRAM).
3. Populate the MMIO cache in SMM: Perform MMIO accesses from within SMM to fill the per-vCPU MMIO cache with entries tagged with the SMM memslot generation (incorrectly using address space 0's generation).
4. Trigger SMM memslot update: Cause an update to the SMM memslots (e.g., via guest-controlled memory region changes), which should invalidate the cached MMIO entries but does not due to the address space mismatch.
5. Return to normal address space: Exit SMM so the vCPU returns to address space 0, where the stale MMIO cache entries remain apparently valid.
6. Access RAM at the same GFN: Perform a memory access to a valid RAM page at the same Guest Frame Number (GFN) as the stale MMIO cache entry, causing KVM to incorrectly surface it as KVM_EXIT_MMIO to the VMM.
7. Corrupt nested EPT tables: The VMM writes to the backing page (which backs a nested EPT table) without going through KVM's write-tracking path, corrupting shadow translations and potentially achieving arbitrary code execution at hypervisor privilege level (GitHub Advisory, Feedly).

• Logs: Kernel log entries containing WARN_ON_ONCE warnings from kvm_mmu_write_protect_fault(), indicating an invalid cache and memslot combination has been detected.
• Process/Hypervisor Behavior: Unexpected KVM_EXIT_MMIO exits from a vCPU for addresses that correspond to valid guest RAM rather than MMIO regions, observable via KVM tracing (/sys/kernel/debug/tracing/events/kvm/).
• System: Unexplained guest VM crashes, hangs, or erratic behavior in nested virtualization environments that may indicate EPT table corruption.
• Kernel: Presence of kvm_mmu_write_protect_fault warnings in dmesg or /var/log/kern.log on KVM hosts running affected kernel versions (GitHub Advisory).

Apply the Linux kernel security patch that converts the MMIO cache helpers to use kvm_vcpu_memslots() (active memslots) instead of kvm_memslots() (which unconditionally selects address space 0). Fixed versions include Linux kernel 6.6.160, 6.12.114, 6.18.58, 7.2.12, and 7.3 (mainline). The specific fix commits are: a63f79d9da94, 7fd4e64f4bbc, 2566780c684c, e792a9ace39d, and b3e6212dea2e in the stable kernel tree. Until patching is possible, consider restricting guest access to SMM or disabling nested virtualization where feasible (GitHub Advisory).