Unscored severity · published Oct 28, 2026
CVE-2026-99168
mshv_vtl: Check per-CPU register page before mmap
New
–
CVSS
–
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
mshv_vtl: Check per-CPU register page before mmap
Register-page setup is optional for each CPU. If allocation or
registration fails, mshv_vtl_configure_reg_page() warns and leaves that
CPU's reg_page NULL, but initial context setup continues successfully.
Meanwhile, successful setup on another CPU sets the global
mshv_has_reg_page flag.
mshv_vtl_fault() checks this global flag before selecting the requested
CPU's register page. With mixed setup results across online CPUs, the
check passes even for a CPU with no register page, reaching
get_page(NULL) when userspace faults in that mapping.
Check the selected per-CPU register page before taking its reference and
return VM_FAULT_SIGBUS if it is absent.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Linux · Linux
7bfe3b8ea6e30437e01fcb8e4f56ef6e4d986d0f before 5c0757b065fbd140d8fbd05dc2c2146b713dfa68; 7bfe3b8ea6e30437e01fcb8e4f56ef6e4d986d0f before 874194a8de75fc2f4d1fb70c670b289b7e48f93e; 6.19 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-99168
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-99168
git.kernel.org
https://git.kernel.org/stable/c/5c0757b065fbd140d8fbd05dc2c2146b713dfa68
git.kernel.org
https://git.kernel.org/stable/c/874194a8de75fc2f4d1fb70c670b289b7e48f93e
More from Linux
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
7.8
CVE-2026-53362
ipv6: account for fraggap on the paged allocation path
7.8
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
7.8
CVE-2025-38352
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
