CVE-2026-53345

In the Linux kernel, the following vulnerability has been resolved:

KVM: Dont WARN if memory is dirtied without a vCPU when the VM is dying

When marking a page dirty, complain about not having a running/loaded vCPU if and only if the VM is still alive, i.e. its refcount is non-zero. This will allow fixing a memory leak for x86 SEV-ES guests without hitting what is effectively a false positive on the WARN.

For some SEV-ES VM-Exits, KVM keeps a writable mapping of a guest page across an exit to userspace, and typically unmaps the page on the next KVM_RUN. But if userspace never calls KVM_RUN after such an exit, then KVM needs to unmap the page when the vCPU is destroyed, which in turn triggers the WARN about not having a running vCPU.

Alternatively, SEV-ES could temporarily load the vCPU to suppress the WARN, as is done in nested_vmx_free_vcpu() (but for completely unrelated reasons; suppressing WARN from nested_put_vmcs12_pages() is pure happenstance). But loading a vCPU during destruction is gross (ideally nVMX code would be cleaned up), risks complicating the SEV-ES code (KVM would need to ensure the temporarily load()+put() only runs when the vCPU isnt already loaded), and is ultimately pointless.

The motivation for the WARN is to guard against KVM dirtying guest memory without pushing the corresponding GFN to the active vCPUs dirty ring, e.g. to ensure userspace doesnt miss a dirty page. But for the VMs refcount to reach zero, there cant be any userspace mappings to the dirty ring, as mapping the dirty ring requires doing mmap() on the vCPU FD. I.e. if userspace had a valid mapping for the dirty ring, then the vCPU file and thus the owning VM would still be alive. And so since userspace cant possibly reach the dirty ring, whether or not KVM technically misses a push to the dirty ring is irrelevant.

Weakness

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Affected Software

Potential Mitigations

• Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
• For example, glibc in Linux provides protection against free of invalid pointers.
• When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
• To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.

References

• https://git.kernel.org/stable/c/033d39e41fc30f484f4e4f37fb4cd76b12cbb18e
• https://git.kernel.org/stable/c/343e95c8ecc40e0738975ef4ee24c0c35e800e6b
• https://git.kernel.org/stable/c/66a8e7ddd901023c89a2733494d827eca3f9c1b0
• https://git.kernel.org/stable/c/8618004d3e897c0f1b71d9a9ab860461289bb89a
• https://git.kernel.org/stable/c/99d7d43784ae3235026581e9bf892c036e04c8e6