CVE-2026-64283

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> KVM: guest_memfd: Treat memslot binding offset+size as unsigned values<br /> <br /> When binding a memslot to a guest_memfd file, treat the offset and size as<br /> unsigned values to fix a bug where the sum of the two can result in a false<br /> negative when checking for overflow against the size of the file. Passing<br /> unsigned values also avoids relying on somewhat obscure checks in other<br /> flows for safety, and tracks the offset and size as they are intended to be<br /> tracked, as unsigned values.<br /> <br /> On 64-bit kernels, the number of pages a memslot contains and thus the size<br /> (and offset) of its guest_memfd binding are unsigned 64-bit values. Taking<br /> the offset+size as an loff_t instead of a uoff_t inadvertently converts<br /> the unsigned value to a signed value if the offset and/or size is massive.<br /> <br /> Locally storing the offset and size as signed values is benign in and of<br /> itself (though even that is *extremely* difficult to discern), but<br /> operating on their sum is not.<br /> <br /> For the offset, KVM explicitly checks against a negative value, which might<br /> seem like a bug as KVM could incorrectly reject a legitimate binding, but<br /> that&amp;#39;s not actually the case as KVM_CREATE_GUEST_MEMFD takes a signed value<br /> for its size, i.e. a would-be-negative offset is also greater than the<br /> maximum possible size of any guest_memfd file.<br /> <br /> Regarding the size, while KVM lacks an explicit check for a negative value,<br /> i.e. seemingly has a flawed overflow check, KVM restricts the number of<br /> pages in a single memslot to the largest positive signed 32-bit value:<br /> <br /> if (id memory_size &gt;&gt; PAGE_SHIFT) &gt; KVM_MEM_MAX_NR_PAGES)<br /> return -EINVAL;<br /> <br /> and so that maximum "size" will ever be is 0x7fffffff000.<br /> <br /> The sum of the two is, however, problematic. While the size is restricted<br /> by KVM&amp;#39;s memslot logic, the offset is not, i.e. the offset is completely<br /> unchecked until the "offset + size &gt; i_size_read(inode)" check. If the<br /> offset is the (nearly) largest possible _positive_ value, then adding size<br /> to the offset can result in a signed, negative 64-bit value. When compared<br /> against the size of the file (guaranteed to be positive), the negative sum<br /> is always smaller, and KVM incorrectly allows the absurd offset.<br /> <br /> Opportunistically add missing includes in kvm_mm.h (instead of relying on<br /> its parents).