Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2026-89928

Опубликовано: 16 сент. 2026
Источник: nvd
CVSS3: 8.8
EPSS Низкий

Описание

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk

__kvm_rmap_lock() deliberately elides the rmap lock when it observes an empty rmap. In that case kvm_rmap_lock_readonly() also re-enables preemption and returns zero, so the caller holds neither the rmap lock nor a preemption reference. The elision documents the invariant it relies on:

* Elide the lock if the rmap is empty, as lockless walkers (read-only * mode) don't need to (and can't) walk an empty rmap, nor can they add * entries to the rmap. I.e. the only paths that process empty rmaps * do so while holding mmu_lock for write, and are mutually exclusive.

kvm_rmap_age_gfn_range() ignores the returned value and unconditionally enters for_each_rmap_spte_lockless(). The iterator started with rmap_get_first(), which re-reads rmap_head->val rather than using the value returned by the lock. If a writer populates the rmap between the lo

EPSS

Процентиль: 5%
0.00157
Низкий

8.8 High

CVSS3

Дефекты

Связанные уязвимости

CVSS3: 8.8
ubuntu
5 дней назад

(In the Linux kernel, the following vulnerability has been resolved: K ...)

CVSS3: 8.8
debian
6 дней назад

In the Linux kernel, the following vulnerability has been resolved: K ...

CVSS3: 8.8
github
6 дней назад

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk __kvm_rmap_lock() deliberately elides the rmap lock when it observes an empty rmap. In that case kvm_rmap_lock_readonly() also re-enables preemption and returns zero, so the caller holds neither the rmap lock nor a preemption reference. The elision documents the invariant it relies on: * Elide the lock if the rmap is empty, as lockless walkers (read-only * mode) don't need to (and can't) walk an empty rmap, nor can they add * entries to the rmap. I.e. the only paths that process empty rmaps * do so while holding mmu_lock for write, and are mutually exclusive. kvm_rmap_age_gfn_range() ignores the returned value and unconditionally enters for_each_rmap_spte_lockless(). The iterator started with rmap_get_first(), which re-reads rmap_head->val rather than using the value returned by the lock. If a writer populates the rmap between the...

EPSS

Процентиль: 5%
0.00157
Низкий

8.8 High

CVSS3

Дефекты