CVE-2026-43348: mshv_vtl: Fix vmemmap_shift exceeding MAX_FOLIO_ORDER
In the Linux kernel, the following vulnerability has been resolved:
mshvvtl: Fix vmemmapshift exceeding MAXFOLIOORDER
When registering VTL0 memory via MSHVADDVTL0MEMORY, the kernel computes pgmap->vmemmapshift as the number of trailing zeros in the OR of startpfn and lastpfn, intending to use the largest compound page order both endpoints are aligned to.
However, this value is not clamped to MAXFOLIOORDER, so a sufficiently aligned range (e.g. physical range [0x800000000000, 0x800080000000), corresponding to startpfn=0x800000000 with 35 trailing zeros) can produce a shift larger than what memremappages() accepts, triggering a WARN and returning -EINVAL:
WARNING: ... memremappages+0x512/0x650 requested folio size unsupported
The MAXFOLIOORDER check was added by commit 646b67d57589 ("mm/memremap: reject unreasonable folio/compound page sizes in memremappages()").
Fix this by clamping vmemmapshift to MAXFOLIOORDER so we always request the largest order the kernel supports, in those cases, rather than an out-of-range value.
Also fix the error path to propagate the actual error code from devmmemremappages() instead of hard-coding -EFAULT, which was masking the real -EINVAL return.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Avoid registering VTL0 memory ranges whose start_pfn and last_pfn produce a vmemmap_shift larger than the kernel's supported MAX_FOLIO_ORDER (i.e., avoid extremely large-alignment physical ranges when invoking MSHV_ADD_VTL0_MEMORY), or validate/normalize PFN ranges in the caller to ensure alignment does not exceed supported folio order.
- Operational
Search kernel logs (dmesg) for warnings like 'requested folio size unsupported' or memremap_pages WARNs and for MSHV_ADD_VTL0_MEMORY failures returning -EINVAL; after applying the kernel fix, verify the WARN no longer appears and VTL0 memory registration succeeds.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43348?
CVE-2026-43348 has been categorized as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2026-43348?
To fix CVE-2026-43348, ensure you update your Linux kernel to version 6.19 or later.
What systems are affected by CVE-2026-43348?
CVE-2026-43348 affects the Linux kernel versions between 6.19 and 7.0.2.
What type of vulnerability is CVE-2026-43348?
CVE-2026-43348 is a vulnerability related to memory management within the Linux kernel.
When was CVE-2026-43348 publicly disclosed?
CVE-2026-43348 was publicly disclosed on the official Linux kernel repository.