{
  "threat_severity" : "Moderate",
  "public_date" : "2026-05-28T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN",
    "id" : "2482587",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2482587"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-416",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nKVM: x86: Fix shadow paging use-after-free due to unexpected GFN\nThe shadow MMU computes GFNs for direct shadow pages using sp->gfn plus\nthe SPTE index. This assumption breaks for shadow paging if the guest\npage tables are modified between VM entries (similar to commit\naad885e77496, \"KVM: x86/mmu: Drop/zap existing present SPTE even\nwhen creating an MMIO SPTE\", 2026-03-27).  The flow is as follows:\n- a PDE is installed for a 2MB mapping, and a page in that area is\naccessed.  KVM creates a kvm_mmu_page consisting of 512 4KB pages;\nthe kvm_mmu_page is marked by FNAME(fetch) as direct-mapped because\nthe guest's mapping is a huge page (and thus contiguous).\n- the PDE mapping is changed from outside the guest.\n- the guest accesses another page in the same 2MB area.  KVM installs\na new leaf SPTE and rmap entry; the SPTE uses the \"correct\" GFN\n(i.e. based on the new mapping, as changed in the previous step) but\nthat GFN is outside of the [sp->gfn, sp->gfn + 511] range; therefore\nthe rmap entry cannot be found and removed when the kvm_mmu_page\nis zapped.\n- the memslot that covers the first 2MB mapping is deleted, and the\nkvm_mmu_page for the now-invalid GPA is zapped.  However, rmap_remove()\nonly looks at the [sp->gfn, sp->gfn + 511] range established in step 1,\nand fails to find the rmap entry that was recorded by step 3.\n- any operation that causes an rmap walk for the same page accessed\nby step 3 then walks a stale rmap and dereferences a freed kvm_mmu_page.\nThis includes dirty logging or MMU notifier invalidations (e.g., from\nMADV_DONTNEED).\nThe underlying issue is that KVM's walking of shadow PTEs assumes that\nif a SPTE is present when KVM wants to install a non-leaf SPTE, then the\nexisting kvm_mmu_page must be for the correct gfn.  Because the only way\nfor the gfn to be wrong is if KVM messed up and failed to zap a SPTE...\nwhich shouldn't happen, but *actually* only happens in response to a\nguest write.\nThat bug dates back literally forever, as even the first version of KVM\nassumes that the GFN matches and walks into the \"wrong\" shadow page.\nHowever, that was only an imprecision until 2032a93d66fa (\"KVM: MMU:\nDon't allocate gfns page for direct mmu pages\") came along.\nFix it by checking for a target gfn mismatch and zapping the existing\nSPTE.  That way the old SP and rmap entries are gone, KVM installs\nthe rmap in the right location, and everyone is happy.", "A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) x86 shadow paging mechanism. This use-after-free vulnerability arises from incorrect handling of Guest Frame Numbers (GFNs) when guest page tables are modified. A local attacker with control over a guest virtual machine could exploit this to dereference freed memory, potentially leading to information disclosure, privilege escalation, or a denial of service (DoS)." ],
  "statement" : "The attack vector is from the guest to the host if KVM being used (and Shadow paging being used). KVM x86 shadow paging can leave a stale rmap entry when a direct shadow page is reused with an unexpected GFN after guest page table changes between VM entries. Later memslot deletion, dirty logging, or MMU notifier invalidation can walk the stale rmap and dereference a freed kvm_mmu_page, resulting in a use-after-free in the host kernel. For the CVSS the PR:L is used because a local actor with access to KVM or control of a guest execution context can influence the guest mappings and related memory management operations. The issue is not a normal network reachable bug, but it can cross the guest to host boundary in virtualized deployments. Impact is at least host denial of service and in the paranoid score may include confidentiality and integrity impact due to a plausible UAF based memory corruption primitive.\nFor the paranoid score, choose the highest still-defensible interpretation supported by the bug class and patch context, with preference for manual-review sensitivity over autoclosed false negat\nives.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:36956",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "kernel-0:6.12.0-211.32.1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-07-14T00:00:00Z",
    "advisory" : "RHSA-2026:39082",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::nfv",
    "package" : "kernel-rt-0:4.18.0-553.143.1.rt7.484.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-07-14T00:00:00Z",
    "advisory" : "RHSA-2026:39083",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-553.143.1.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
    "release_date" : "2026-07-17T00:00:00Z",
    "advisory" : "RHSA-2026:41229",
    "cpe" : "cpe:/o:redhat:rhel_tus:8.8",
    "package" : "kernel-0:4.18.0-477.154.1.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
    "release_date" : "2026-07-17T00:00:00Z",
    "advisory" : "RHSA-2026:41229",
    "cpe" : "cpe:/o:redhat:rhel_e4s:8.8",
    "package" : "kernel-0:4.18.0-477.154.1.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:36957",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-687.24.1.el9_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:36957",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-687.24.1.el9_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2026-07-15T00:00:00Z",
    "advisory" : "RHSA-2026:40082",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "kernel-0:5.14.0-284.181.1.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2026-07-15T00:00:00Z",
    "advisory" : "RHSA-2026:39983",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2::nfv",
    "package" : "kernel-rt-0:5.14.0-284.181.1.rt14.466.el9_2"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-46113\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46113\nhttps://lore.kernel.org/linux-cve-announce/2026052813-CVE-2026-46113-f083@gregkh/T" ],
  "name" : "CVE-2026-46113",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}