CVE-2026-99168: mshv_vtl: Check per-CPU register page before mmap

Published Oct 28, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

mshvvtl: Check per-CPU register page before mmap

Register-page setup is optional for each CPU. If allocation or registration fails, mshvvtlconfigureregpage() warns and leaves that CPU's regpage NULL, but initial context setup continues successfully. Meanwhile, successful setup on another CPU sets the global mshvhasregpage flag.

mshvvtlfault() checks this global flag before selecting the requested CPU's register page. With mixed setup results across online CPUs, the check passes even for a CPU with no register page, reaching getpage(NULL) when userspace faults in that mapping.

Check the selected per-CPU register page before taking its reference and return VMFAULTSIGBUS if it is absent.

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 28, 2026

CVE Published

via MITRE·10:35 AM

Data Sourced

via MITRE·10:35 AM

Description

Data Sourced

via NVD·11:17 AM

Description

Frequently Asked Questions

What systems are exposed to this condition?

Systems using the Linux kernel mshv_vtl functionality are exposed when register-page setup succeeds on at least one online CPU but fails or is not registered on another online CPU. The issue depends on this mixed per-CPU setup state.

What must happen for the vulnerable path to be reached?

Userspace must fault in a mapping for a CPU whose register page is absent. Because the global register-page flag can have been set by successful setup on a different CPU, the fault handler can attempt get_page(NULL) for the selected CPU.

How can administrators determine whether they may be affected?

Check for warnings from mshv_vtl_configure_reg_page() indicating register-page allocation or registration failed on a CPU, while register-page setup succeeded for another CPU. That mixed result is the condition described for triggering the faulty mapping path.

What is the safe behavior after the fix when a selected CPU has no register page?

The fault handler checks the selected CPU's register page before taking a reference. If it is absent, it returns VM_FAULT_SIGBUS rather than dereferencing a NULL page pointer.

CVE-2026-99168: mshv_vtl: Check per-CPU register page before mmap

Affected Software

Event History

Frequently Asked Questions

What systems are exposed to this condition?

What must happen for the vulnerable path to be reached?

How can administrators determine whether they may be affected?

What is the safe behavior after the fix when a selected CPU has no register page?

Company

Resources

Contact

Frequently Asked Questions

What systems are exposed to this condition?

What must happen for the vulnerable path to be reached?

How can administrators determine whether they may be affected?

What is the safe behavior after the fix when a selected CPU has no register page?