CVE-2026-64247

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> KVM: x86: hyper-v: Bound the bank index when querying sparse banks<br /> <br /> When checking if a VP ID is included in a sparse bank set, explicitly check<br /> that the ID can actually be contained in a sparse bank (the TLFS allows for<br /> a maximum of 64 banks of 64 vCPUs each). When handling a paravirtual TLB<br /> flush for L2, the VP ID is copied verbatim from the enlightened VMCS,<br /> without any bounds check, i.e. isn&amp;#39;t guaranteed to be under the limit of<br /> 4096.<br /> <br /> Failure to check the bounds of the VP ID leads to an out-of-bounds read<br /> when testing the sparse bank, and super strictly speaking could lead to KVM<br /> performing an unnecessary TLB flush for an L2 vCPU.<br /> <br /> ==================================================================<br /> BUG: KASAN: use-after-free in hv_is_vp_in_sparse_set+0x85/0x100 [kvm]<br /> Read of size 8 at addr ffff88811ba5f598 by task hyperv_evmcs/2802<br /> <br /> CPU: 12 UID: 1000 PID: 2802 Comm: hyperv_evmcs Not tainted 7.1.0-rc2 #7 PREEMPT<br /> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x51/0x60<br /> print_report+0xcb/0x5d0<br /> kasan_report+0xb4/0xe0<br /> kasan_check_range+0x35/0x1b0<br /> hv_is_vp_in_sparse_set+0x85/0x100 [kvm]<br /> kvm_hv_flush_tlb+0xe9e/0x16c0 [kvm]<br /> kvm_hv_hypercall+0xe6b/0x1e60 [kvm]<br /> vmx_handle_exit+0x485/0x1b60 [kvm_intel]<br /> kvm_arch_vcpu_ioctl_run+0x22e3/0x5070 [kvm]<br /> kvm_vcpu_ioctl+0x5d0/0x10c0 [kvm]<br /> __x64_sys_ioctl+0x129/0x1a0<br /> do_syscall_64+0xb9/0xcf0<br /> entry_SYSCALL_64_after_hwframe+0x4b/0x53<br /> RIP: 0033:0x7f0e62d1a9bf<br /> <br /> <br /> The buggy address belongs to the physical page:<br /> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffffffffffffffff pfn:0x11ba5f<br /> flags: 0x4000000000000000(zone=1)<br /> raw: 4000000000000000 0000000000000000 00000000ffffffff 0000000000000000<br /> raw: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000000<br /> page dumped because: kasan: bad access detected<br /> <br /> Memory state around the buggy address:<br /> ffff88811ba5f480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br /> ffff88811ba5f500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br /> &gt;ffff88811ba5f580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br /> ^<br /> ffff88811ba5f600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br /> ffff88811ba5f680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br /> ==================================================================<br /> Disabling lock debugging due to kernel taint<br /> <br /> Opportunistically add a compile time assertion to ensure the maximum number<br /> of sparse banks exactly matches the number of possible bits in the passed<br /> in mask.<br /> <br /> [sean: add KASAN splat, drop comment, add assert, massage changelog]