CVE-2026-68166: userfaultfd: prevent registration of special VMAs
In the Linux kernel, the following vulnerability has been resolved:
userfaultfd: prevent registration of special VMAs
Vova Tokarev says:
userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can register on the shadow stack, discard a page ... and inject a page with chosen return addresses via UFFDIOCOPY.
Update vmacanuserfault() to reject VMSHADOWSTACK.
While on it, also reject VMSPECIAL so that if a driver would implement vmuffdops, it wouldn't be possible to register special VMAs with userfaultfd.
Since VMSPECIAL includes VMDONTEXPAND which is set but hugetlb, exclude hugetlb VMAs from the check for VMSPECIAL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update vma_can_userfault() to reject VM_SHADOW_STACK so userfaultfd registration is prevented for shadow stack VMAs.
Linux kernel (vma_can_userfault / userfaultfd registration) VM_SHADOW_STACK acceptance = reject - Configuration
While on it, also reject VM_SPECIAL in vma_can_userfault() so special VMAs (including hugetlb VMAs that include VM_DONTEXPAND via VM_SPECIAL) are excluded from the userfaultfd registration check.
Linux kernel (vma_can_userfault / userfaultfd registration) VM_SPECIAL acceptance = reject
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68166?
CVE-2026-68166 has a risk rating of 58.
How do I fix CVE-2026-68166?
To resolve CVE-2026-68166, ensure you update your Linux kernel to the latest version where the vulnerability has been patched.
What systems are affected by CVE-2026-68166?
CVE-2026-68166 affects systems running vulnerable versions of the Linux kernel that allow userfaultfd registration on special VMAs.
What impact does CVE-2026-68166 have on system security?
CVE-2026-68166 can potentially allow unauthorized page injection, undermining the integrity of the shadow stack.
Who can exploit CVE-2026-68166?
Any attacker with access to userfaultfd can exploit CVE-2026-68166 to manipulate vulnerable VMAs.