GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-23432 (GCVE-0-2026-23432)

Vulnerability from cvelistv5 – Published: 2026-04-03 15:15 – Updated: 2026-08-05 12:21
VLAI
Title
mshv: Fix use-after-free in mshv_map_user_memory error path
Summary
In the Linux kernel, the following vulnerability has been resolved: mshv: Fix use-after-free in mshv_map_user_memory error path In the error path of mshv_map_user_memory(), calling vfree() directly on the region leaves the MMU notifier registered. When userspace later unmaps the memory, the notifier fires and accesses the freed region, causing a use-after-free and potential kernel panic. Replace vfree() with mshv_partition_put() to properly unregister the MMU notifier before freeing the region.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b9a66cd5ccbb9fade15d0e427e19470d8ad35b75 , < 34861bdc0c0196b6c2dd48f7454029407704ff6e (git)
Affected: b9a66cd5ccbb9fade15d0e427e19470d8ad35b75 , < 6922db250422a0dfee34de322f86b7a73d713d33 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 6.19.10 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hv/mshv_root_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "34861bdc0c0196b6c2dd48f7454029407704ff6e",
              "status": "affected",
              "version": "b9a66cd5ccbb9fade15d0e427e19470d8ad35b75",
              "versionType": "git"
            },
            {
              "lessThan": "6922db250422a0dfee34de322f86b7a73d713d33",
              "status": "affected",
              "version": "b9a66cd5ccbb9fade15d0e427e19470d8ad35b75",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hv/mshv_root_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.10",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmshv: Fix use-after-free in mshv_map_user_memory error path\n\nIn the error path of mshv_map_user_memory(), calling vfree() directly on\nthe region leaves the MMU notifier registered. When userspace later unmaps\nthe memory, the notifier fires and accesses the freed region, causing a\nuse-after-free and potential kernel panic.\n\nReplace vfree() with mshv_partition_put() to properly unregister\nthe MMU notifier before freeing the region."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local `/dev/mshv` and partition-file ioctls, specifically `MSHV_SET_GUEST_MEMORY`, not via network or adjacent protocols.\nAC:L - The attacker controls the memory-region parameters and can subsequently unmap the userspace range to fire the stale MMU notifier. No attacker-uncontrolled race or special victim state is required.\nPR:L - The attacker needs local access to the mshv device or an already-created partition fd, but the vulnerable ioctl itself has no `capable()` check. In a reasonable VMM deployment where that fd/device is granted to a service process, this is Low rather than High.\nUI:N - After obtaining the local mshv interface, the attacker can issue the ioctl and unmap memory without requiring any separate user action.\nS:U - The bug corrupts kernel memory through a kernel driver interface and impacts the same kernel security authority. This is not a guest-to-host escape path from inside a VM.\nC:H - This is a use-after-free of a registered MMU interval notifier embedded in `struct mshv_mem_region`. Reuse of the freed vmalloc object can plausibly expose kernel memory or support read primitives.\nI:H - The stale notifier callback dereferences and writes through fields of freed attacker-reclaimable kernel memory, including notifier sequence and region state. As a kernel UAF, it is plausibly exploitable for memory corruption or control-flow impact.\nA:H - The upstream fix explicitly notes that later userspace unmapping can fire the notifier on freed memory and cause a kernel panic. A local attacker can trigger this repeatedly for host denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:21:43.430Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/34861bdc0c0196b6c2dd48f7454029407704ff6e"
        },
        {
          "url": "https://git.kernel.org/stable/c/6922db250422a0dfee34de322f86b7a73d713d33"
        }
      ],
      "title": "mshv: Fix use-after-free in mshv_map_user_memory error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23432",
    "datePublished": "2026-04-03T15:15:18.061Z",
    "dateReserved": "2026-01-13T15:37:46.016Z",
    "dateUpdated": "2026-08-05T12:21:43.430Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23432",
      "date": "2026-09-20",
      "epss": "0.0012",
      "percentile": "0.02121"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/hv/mshv_root_main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "34861bdc0c0196b6c2dd48f7454029407704ff6e",
                    "status": "affected",
                    "version": "b9a66cd5ccbb9fade15d0e427e19470d8ad35b75",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6922db250422a0dfee34de322f86b7a73d713d33",
                    "status": "affected",
                    "version": "b9a66cd5ccbb9fade15d0e427e19470d8ad35b75",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/hv/mshv_root_main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.19"
                  },
                  {
                    "lessThan": "6.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D70DEFFE-AC47-4F3A-A2B2-2D67AB4CF3C8",
                    "versionEndExcluding": "6.19.10",
                    "versionStartIncluding": "6.19.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*",
                    "matchCriteriaId": "35C8A871-4971-433E-A046-FC9F7B7D190A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmshv: Fix use-after-free in mshv_map_user_memory error path\n\nIn the error path of mshv_map_user_memory(), calling vfree() directly on\nthe region leaves the MMU notifier registered. When userspace later unmaps\nthe memory, the notifier fires and accesses the freed region, causing a\nuse-after-free and potential kernel panic.\n\nReplace vfree() with mshv_partition_put() to properly unregister\nthe MMU notifier before freeing the region."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nmshv: Correcci\u00f3n de uso despu\u00e9s de liberaci\u00f3n en la ruta de error de mshv_map_user_memory\n\nEn la ruta de error de mshv_map_user_memory(), llamar a vfree() directamente sobre la regi\u00f3n deja el notificador de MMU registrado. Cuando el espacio de usuario (userspace) desmapea la memoria m\u00e1s tarde, el notificador se activa y accede a la regi\u00f3n liberada, causando un uso despu\u00e9s de liberaci\u00f3n y un potencial p\u00e1nico del kernel.\n\nReemplace vfree() con mshv_partition_put() para anular correctamente el registro del notificador de MMU antes de liberar la regi\u00f3n."
          }
        ],
        "id": "CVE-2026-23432",
        "lastModified": "2026-07-24T21:10:00.143",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2026-04-03T16:16:24.637",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/34861bdc0c0196b6c2dd48f7454029407704ff6e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6922db250422a0dfee34de322f86b7a73d713d33"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T07:20:58+00:00",
      "cve": "CVE-2026-23432",
      "id": "CVE-2026-23432",
      "initial_release_date": "2026-04-03T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mshv: Fix use-after-free in mshv_map_user_memory error path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23432.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.