CVE-2026-43096

MEDIUM

mshv: Fix infinite fault loop on permission-denied GPA intercepts

Title source: cna
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: mshv: Fix infinite fault loop on permission-denied GPA intercepts Prevent infinite fault loops when guests access memory regions without proper permissions. Currently, mshv_handle_gpa_intercept() attempts to remap pages for all faults on movable memory regions, regardless of whether the access type is permitted. When a guest writes to a read-only region, the remap succeeds but the region remains read-only, causing immediate re-fault and spinning the vCPU indefinitely. Validate intercept access type against region permissions before attempting remaps. Reject writes to non-writable regions and executes to non-executable regions early, returning false to let the VMM handle the intercept appropriately. This also closes a potential DoS vector where malicious guests could intentionally trigger these fault loops to consume host resources.

Scores

CVSS v3 5.5
EPSS 0.0001
EPSS Percentile 1.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-835
Status published
Products (8)
Linux/Linux < 6.19
Linux/Linux 6.19
Linux/Linux 6.19.14 - 6.19.*
Linux/Linux 7.0
Linux/Linux b9a66cd5ccbb9fade15d0e427e19470d8ad35b75 - 02226839079ccc558820a3b25c4c46812927b4ba
Linux/Linux b9a66cd5ccbb9fade15d0e427e19470d8ad35b75 - 16cbec24897624051b324aa3a85859c38ca65fde
linux/linux_kernel 7.0 rc1 (7 CPE variants)
linux/linux_kernel 6.19 - 6.19.14
Published May 06, 2026
Tracked Since May 06, 2026