CVE-2026-52969

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> KVM: Reject wrapped offset in kvm_reset_dirty_gfn()<br /> <br /> kvm_reset_dirty_gfn() guards the gfn range with<br /> <br /> if (!memslot || (offset + __fls(mask)) &gt;= memslot-&gt;npages)<br /> return;<br /> <br /> but offset is u64 and the addition is unchecked. The check can be<br /> silently bypassed by a u64 wrap.<br /> <br /> The dirty ring backing those entries is MAP_SHARED at<br /> KVM_DIRTY_LOG_PAGE_OFFSET of the vcpu fd, so the VMM can rewrite the<br /> slot and offset fields of any entry between when the kernel pushes<br /> them and when KVM_RESET_DIRTY_RINGS consumes them. On reset,<br /> kvm_dirty_ring_reset() re-reads the values via READ_ONCE() and feeds<br /> them straight back into this check; only the flags handshake is<br /> treated as the handover, the slot/offset payload is taken on trust.<br /> <br /> Crafting two entries<br /> <br /> entry[i].offset = 0xffffffffffffffc1<br /> entry[i+1].offset = 0<br /> <br /> makes the coalescing loop in kvm_dirty_ring_reset() compute<br /> <br /> delta = (s64)(0 - 0xffffffffffffffc1) = 63<br /> <br /> which falls in [0, BITS_PER_LONG), so it folds entry[i+1] into the<br /> existing mask by setting bit 63. The trailing kvm_reset_dirty_gfn()<br /> call then sees offset = 0xffffffffffffffc1 and __fls(mask) = 63;<br /> the sum is 0 in u64 and the bounds check passes.<br /> <br /> That offset propagates into kvm_arch_mmu_enable_log_dirty_pt_masked()<br /> unchanged. On the legacy MMU path -- kvm_memslots_have_rmaps() ==<br /> true, i.e. shadow paging, any VM that has allocated shadow roots, or<br /> a write-tracked slot -- it reaches gfn_to_rmap(), which indexes<br /> slot-&gt;arch.rmap[0][] with a near-U64_MAX gfn. That is an<br /> out-of-bounds load of a kvm_rmap_head, followed by a conditional<br /> clear of PT_WRITABLE_MASK in whatever the loaded pointer points at.<br /> The path is reachable from any process holding /dev/kvm.<br /> <br /> Range-check offset on its own first, so the addition cannot wrap.<br /> memslot-&gt;npages is bounded well below U64_MAX, so once offset