CVE-2026-64247: KVM: x86: hyper-v: Bound the bank index when querying sparse banks
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: hyper-v: Bound the bank index when querying sparse banks
When checking if a VP ID is included in a sparse bank set, explicitly check that the ID can actually be contained in a sparse bank (the TLFS allows for a maximum of 64 banks of 64 vCPUs each). When handling a paravirtual TLB flush for L2, the VP ID is copied verbatim from the enlightened VMCS, without any bounds check, i.e. isn't guaranteed to be under the limit of 4096.
Failure to check the bounds of the VP ID leads to an out-of-bounds read when testing the sparse bank, and super strictly speaking could lead to KVM performing an unnecessary TLB flush for an L2 vCPU.
================================================================== BUG: KASAN: use-after-free in hvisvpinsparseset+0x85/0x100 [kvm] Read of size 8 at addr ffff88811ba5f598 by task hypervevmcs/2802
CPU: 12 UID: 1000 PID: 2802 Comm: hypervevmcs Not tainted 7.1.0-rc2 #7 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dumpstacklvl+0x51/0x60 printreport+0xcb/0x5d0 kasanreport+0xb4/0xe0 kasancheckrange+0x35/0x1b0 hvisvpinsparseset+0x85/0x100 [kvm] kvmhvflushtlb+0xe9e/0x16c0 [kvm] kvmhvhypercall+0xe6b/0x1e60 [kvm] vmxhandleexit+0x485/0x1b60 [kvmintel] kvmarchvcpuioctlrun+0x22e3/0x5070 [kvm] kvmvcpuioctl+0x5d0/0x10c0 [kvm] x64sysioctl+0x129/0x1a0 dosyscall64+0xb9/0xcf0 entrySYSCALL64afterhwframe+0x4b/0x53 RIP: 0033:0x7f0e62d1a9bf </TASK>
The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffffffffffffffff pfn:0x11ba5f flags: 0x4000000000000000(zone=1) raw: 4000000000000000 0000000000000000 00000000ffffffff 0000000000000000 raw: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected
Memory state around the buggy address: ffff88811ba5f480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88811ba5f500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff88811ba5f580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88811ba5f600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88811ba5f680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== Disabling lock debugging due to kernel taint
Opportunistically add a compile time assertion to ensure the maximum number of sparse banks exactly matches the number of possible bits in the passed in mask.
[sean: add KASAN splat, drop comment, add assert, massage changelog]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.150.1-1 - Upgrade
Upgrade
Linux kernel (KVM hyper-v)to a version that resolves this vulnerability.Fixed in 7.1.0-rc2 - Upgrade
Upgrade
KVM: x86: hyper-vto a version that resolves this vulnerability.Patch Bound the bank index when querying sparse banks
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected path is KVM on x86 when handling Hyper-V functionality, specifically a paravirtual TLB flush for an L2 nested guest using an enlightened VMCS. The issue involves sparse bank handling for Hyper-V virtual processor IDs.
What condition triggers the invalid memory access?
A paravirtual TLB flush for an L2 guest can supply a VP ID copied verbatim from the enlightened VMCS. If that ID is outside the maximum sparse-bank range of 4,096 vCPUs, KVM can read out of bounds while checking whether the VP ID belongs to a sparse bank set.
How can I recognize this issue on an affected host?
A KASAN-enabled kernel may report a use-after-free read in hv_is_vp_in_sparse_set while processing the Hyper-V enlightened VMCS path. The provided example identifies the task as hyperv_evmcs and reports an 8-byte read.
What should be done to remediate it?
Update to a Linux kernel release that includes the referenced stable fixes. The fix adds a bounds check to ensure a VP ID can be represented in the sparse-bank limit before querying the sparse bank set.