Answer in brief
CVE-2026-23401 records a Medium severity (CVSS 5.5) vulnerability in KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-23401 records a Medium severity (CVSS 5.5) vulnerability in KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=a54aa15c6bda3ca7e2f9e040ba968a1da303e24f <20656cd1f243d3a154aac5dd1b823110b6906fe1 || >=a54aa15c6bda3ca7e2f9e040ba968a1da303e24f <ed5909992f344a7d3f4024261e9f751d9618a27d || >=a54aa15c6bda3ca7e2f9e040ba968a1da303e24f <fd28c5618699180cd69619801e9ae6a5266c0a22 || >=a54aa15c6bda3ca7e2f9e040ba968a1da303e24f <459158151a158a6703b49f3c9de0e536d8bd553f || >=a54aa15c6bda3ca7e2f9e040ba968a1da303e24f <695320de6eadb75aaed8be1787c4ce4c189e4c7b || >=a54aa15c6bda3ca7e2f9e040ba968a1da303e24f <bce7fe59d43531623f3e43779127bfb33804925d || >=a54aa15c6bda3ca7e2f9e040ba968a1da303e24f <aad885e774966e97b675dfe928da164214a71605 | 20656cd1f243d3a154aac5dd1b823110b6906fe1, ed5909992f344a7d3f4024261e9f751d9618a27d, fd28c5618699180cd69619801e9ae6a5266c0a22, 459158151a158a6703b49f3c9de0e536d8bd553f, 695320de6eadb75aaed8be1787c4ce4c189e4c7b, bce7fe59d43531623f3e43779127bfb33804925d, aad885e774966e97b675dfe928da164214a71605 |
| Linux/Linuxgeneric | 5.13 | Not reported |
Published upstream
Apr 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 8, 2026
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was right about it being impossible to convert a shadow-present SPTE to an MMIO SPTE due to a _guest_ write, it failed to account for writes to guest memory that are outside the scope of KVM. E.g. if host userspace modifies a shadowed gPTE to switch from a memslot to emulted MMIO and then the guest hits a relevant page fault, KVM will install the MMIO SPTE without first zapping the shadow-present SPTE. ------------[ cut here ]------------ is_shadow_present_pte(*sptep) WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292 Modules linked in: kvm_intel kvm irqbypass CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm] Call Trace: <TASK> mmu_set_spte+0x237/0x440 [kvm] ept_page_fault+0x535/0x7f0 [kvm] kvm_mmu_do_page_fault+0xee/0x1f0 [kvm] kvm_mmu_page_fault+0x8d/0x620 [kvm] vmx_handle_exit+0x18c/0x5a0 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0x730 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x47fa3f </TASK> ---[ end trace 0000000000000000 ]---
Quoted source text, attributed separately from HOL analysis.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=a54aa15c6bda3ca7e2f9e040ba968a1da303e24f <20656cd1f243d3a154aac5dd1b823110b6906fe1 || >=a54aa15c6bda3ca7e2f9e040ba968a1da303e24f <ed5909992f344a7d3f4024261e9f751d9618a27d || >=a54aa15c6bda3ca7e2f9e040ba968a1da303e24f <fd28c5618699180cd69619801e9ae6a5266c0a22 || >=a54aa15c6bda3ca7e2f9e040ba968a1da303e24f <459158151a158a6703b49f3c9de0e536d8bd553f || >=a54aa15c6bda3ca7e2f9e040ba968a1da303e24f <695320de6eadb75aaed8be1787c4ce4c189e4c7b || >=a54aa15c6bda3ca7e2f9e040ba968a1da303e24f <bce7fe59d43531623f3e43779127bfb33804925d || >=a54aa15c6bda3ca7e2f9e040ba968a1da303e24f <aad885e774966e97b675dfe928da164214a71605 | 20656cd1f243d3a154aac5dd1b823110b6906fe1, ed5909992f344a7d3f4024261e9f751d9618a27d, fd28c5618699180cd69619801e9ae6a5266c0a22, 459158151a158a6703b49f3c9de0e536d8bd553f, 695320de6eadb75aaed8be1787c4ce4c189e4c7b, bce7fe59d43531623f3e43779127bfb33804925d, aad885e774966e97b675dfe928da164214a71605 |
| Linux/Linuxgeneric | 5.13 | Not reported |
Published upstream
Apr 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 8, 2026
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was right about it being impossible to convert a shadow-present SPTE to an MMIO SPTE due to a _guest_ write, it failed to account for writes to guest memory that are outside the scope of KVM. E.g. if host userspace modifies a shadowed gPTE to switch from a memslot to emulted MMIO and then the guest hits a relevant page fault, KVM will install the MMIO SPTE without first zapping the shadow-present SPTE. ------------[ cut here ]------------ is_shadow_present_pte(*sptep) WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292 Modules linked in: kvm_intel kvm irqbypass CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm] Call Trace: <TASK> mmu_set_spte+0x237/0x440 [kvm] ept_page_fault+0x535/0x7f0 [kvm] kvm_mmu_do_page_fault+0xee/0x1f0 [kvm] kvm_mmu_page_fault+0x8d/0x620 [kvm] vmx_handle_exit+0x18c/0x5a0 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0x730 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x47fa3f </TASK> ---[ end trace 0000000000000000 ]---
Quoted source text, attributed separately from HOL analysis.