UBUNTU-CVE-2026-99168: Medium severity vulnerability
In the Linux kernel, the following vulnerability has been resolved: mshvvtl: Check per-CPU register page before mmap Register-page setup is optional for each CPU. If allocation or registration fails, mshvvtlconfigureregpage() warns and leaves that CPU's regpage NULL, but initial context setup continues successfully. Meanwhile, successful setup on another CPU sets the global mshvhasregpage flag. mshvvtlfault() checks this global flag before selecting the requested CPU's register page. With mixed setup results across online CPUs, the check passes even for a CPU with no register page, reaching getpage(NULL) when userspace faults in that mapping. Check the selected per-CPU register page before taking its reference and return VMFAULTSIGBUS if it is absent.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In mshv_vtl_fault(), check the selected CPU's per-CPU register page before taking its reference or calling get_page(); if the page is absent (NULL), return VM_FAULT_SIGBUS.
Event History
Frequently Asked Questions
Which systems are exposed to this condition?
Exposure requires mixed register-page setup results across online CPUs: at least one CPU must successfully set up a register page, while another CPU has no register page because allocation or registration failed. The affected path is reached when userspace faults in the mapping associated with the CPU lacking a register page.
What would an attacker or triggering process need to do?
The triggering condition is a userspace page fault in the register-page mapping for a CPU whose register page is absent. A successful register-page setup on a different CPU causes the global availability check to pass, allowing the missing per-CPU page to be used.
How can administrators identify a potentially affected setup?
Look for warnings from mshv_vtl_configure_reg_page() indicating register-page allocation or registration failed for a CPU. A system is potentially affected if such a failure occurred while register-page setup succeeded on at least one other online CPU.
What does the fix change?
The fixed code validates the selected CPU's register page rather than relying only on the global flag. If that per-CPU page is absent, it returns VM_FAULT_SIGBUS instead of attempting get_page(NULL).