CVE-2026-63806

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Drop a BUG_ON() that has been reachable since it was first added, way back in 2009, and instead use get_unaligned() to perform potentially-unaligned accesses. For a given store, KVM x86's emulator tracks the entire value in the destination operand, x86_emulate_ctxt.dst. If the destination is memory, and the target splits multiple pages and/or is emulated MMIO, then KVM handles each fragment independently. E.g. on a page split starting at pag...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= d34e6b175e61821026893ec5298cc8e7558df43a < 2426c15c1395b7d5ccf1e5025ca898af7f3decb6, >= d34e6b175e61821026893ec5298cc8e7558df43a < 4186c850789906b875a1d263377a4d37c078e317, >= d34e6b175e61821026893ec5298cc8e7558df43a < 36ff44fb3d89960391e013fb9d91e23dbc48be47, >= d34e6b175e61821026893ec5298cc8e7558df43a < 92fc631b69deb1c7d56aec2663003600799dcd75, >= d34e6b175e61821026893ec5298cc8e7558df43a < bf89e3738480d33cd515b4a18900e8443d40cd2e, >= d34e6b175e61821026893ec5298cc8e7558df43a < 5da9b1a87ec7cc3489c27016313524769f12d9e0, >= d34e6b175e61821026893ec5298cc8e7558df43a < 5c87b47374682f69686068ad0a7779365a527b1c, >= d34e6b175e61821026893ec5298cc8e7558df43a < f1edbed787ba67988ed34e0132ca128b052b6ce8, >= 2.6.32, >= 2.6.32 < 5.10.261, >= 5.11 < 5.15.212, >= 5.16 < 6.1.178, >= 6.2 < 6.6.145, >= 6.7 < 6.12.95, >= 6.13 < 6.18.38, >= 6.19 < 7.1.3

Fixed versions

5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.95, 6.18.38, 7.1.3

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

CWE

CWE-617