Linux kernel KVM (POWER): Use-after-free in nested guest TLB invalidation
Summary
A use-after-free flaw in the Linux kernel's KVM code for IBM POWER (Book3S HV) affects the TLB invalidation of nested guests. The loop over nested guests drops its lock without holding a reference, so a concurrent vCPU can free the structure first. Exploitation requires local access with low privileges on a POWER KVM host; the CVSS vector indicates high impact on confidentiality, integrity and availability with a scope change.
Affected
- Linux kernel from 4.20 onward (introduced by commit e3b6b4661527e821ffbe3db83952fdb1e6e47c49)
- Only hosts running KVM on IBM POWER (Book3S HV) are affected
Fixed in
- Stable branches per CNA record: 6.1.189, 6.6.158, 6.12.112, 6.18.54 and 7.2.8
- Mainline: fix included in the PowerPC tree (powerpc-7.3-4); release containing it: Unknown
- Distribution fixes: Unknown
Workaround
Unknown. No workaround found in the sources. Hosts without KVM on POWER are not affected.
Exploitation
- Not listed in CISA KEV.
- EPSS below 1 percent.
- Public exploit: none found.
- Exploited in the wild: nothing known.
Our recommendation
- Install a fixed kernel from your distribution or the stable branch; distribution fixes may lag, so check your vendor advisories.
- Check whether you run KVM on IBM POWER hosts; if not, this issue does not apply.
- Restrict local access to KVM hosts and monitor for kernel crashes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux stable commit 24b634852413229bb8340d908b115c3365f3a247 git.kernel.org
- Linux stable commit 4d8f7b1f586375df8bce23a0909566ad5e852259 git.kernel.org
- Linux stable commit e37fba1ba69385cff2d0e60b371ee19e7d1852d1 git.kernel.org
- Linux stable commit ec2d7a52b3996ae81131617b4afc0af31583c1b4 git.kernel.org
- Linux stable commit fbf69b7d0555ee83c871f58750770f74b7179ad1 git.kernel.org
- Linux stable commit 51938dfa8a51a4f85328413fca9b6e21f9d2d088 git.kernel.org
- Ubuntu security tracker entry ubuntu.com
- PowerPC maintainers tree release powerpc-7.3-4 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:23.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() kvmhv_emulate_tlbie_all_lpid() iterates the nested-guest IDR and drops mmu_lock before calling kvmhv_emulate_tlbie_lpid(), but does not hold a reference on the kvm_nested_guest pointer obtained from the IDR. A concurrent vCPU issuing a single-LPID tlbie (is=2, ric=2) can race through kvmhv_flush_nested() -> kvmhv_remove_nested() -> idr_remove / --refcnt -> kvmhv_release_nested() -> kfree(gp) in that window, leaving the iterating vCPU with a dangling pointer. The subsequent mutex_lock(&gp->tlb_lock) and accesses to gp->shadow_pgtable, gp->shadow_lpid and gp->l1_host all touch freed memory. The free path is fully L1-controlled. Fix this by incrementing gp->refcnt inside the loop before dropping mmu_lock, mirroring what kvmhv_get_nested() does, and releasing the reference with kvmhv_put_nested() after the per-guest work completes. This is the same get/put discipline already used at every other call site that drops mmu_lock while holding a nested-guest pointer.
NVD references (6)
- https://git.kernel.org/stable/c/24b634852413229bb8340d908b115c3365f3a247
- https://git.kernel.org/stable/c/4d8f7b1f586375df8bce23a0909566ad5e852259
- https://git.kernel.org/stable/c/51938dfa8a51a4f85328413fca9b6e21f9d2d088
- https://git.kernel.org/stable/c/e37fba1ba69385cff2d0e60b371ee19e7d1852d1
- https://git.kernel.org/stable/c/ec2d7a52b3996ae81131617b4afc0af31583c1b4
- https://git.kernel.org/stable/c/fbf69b7d0555ee83c871f58750770f74b7179ad1
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.