« Volver al listado

CVE-2026-68166

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

userfaultfd: prevent registration of special VMAs

Vova Tokarev says:

Update vma_can_userfault() to reject VM_SHADOW_STACK.

While on it, also reject VM_SPECIAL so that if a driver would implement vm_uffd_ops, it wouldn't be possible to register special VMAs with userfaultfd.

Since VM_SPECIAL includes VM_DONTEXPAND which is set but hugetlb, exclude hugetlb VMAs from the check for VM_SPECIAL.

Detalles técnicos trazas, registros y código del informe original
  userfaultfd allows registration on shadow stack VMAs.  With userfaultfd
  access, you can register on the shadow stack, discard a page ... and
  inject a page with chosen return addresses via UFFDIO_COPY.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-68166",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "54007f818206dc27309ca423df4c87dd160a7208",
              "lessThan": "d974b4b786214883bd8e56bda10b454c80fd6205",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "54007f818206dc27309ca423df4c87dd160a7208",
              "lessThan": "495a28d5a100be1b232633f4c2dcc42ba10b3796",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "54007f818206dc27309ca423df4c87dd160a7208",
              "lessThan": "165613191ad9d034bf17c00e3a142f9561597ec5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "54007f818206dc27309ca423df4c87dd160a7208",
              "lessThan": "0c26202b157f1efc3cd2f26f5c30f59b508a6a5d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "54007f818206dc27309ca423df4c87dd160a7208",
              "lessThan": "3c58f641e813c3c71039f8fd4d4e2a3aab713288",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "mm/userfaultfd.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.6",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "mm/userfaultfd.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-10T13:20:03.110",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0c26202b157f1efc3cd2f26f5c30f59b508a6a5d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/165613191ad9d034bf17c00e3a142f9561597ec5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3c58f641e813c3c71039f8fd4d4e2a3aab713288",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/495a28d5a100be1b232633f4c2dcc42ba10b3796",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d974b4b786214883bd8e56bda10b454c80fd6205",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nuserfaultfd: prevent registration of special VMAs\n\nVova Tokarev says:\n\n  userfaultfd allows registration on shadow stack VMAs.  With userfaultfd\n  access, you can register on the shadow stack, discard a page ... and\n  inject a page with chosen return addresses via UFFDIO_COPY.\n\nUpdate vma_can_userfault() to reject VM_SHADOW_STACK.\n\nWhile on it, also reject VM_SPECIAL so that if a driver would implement\nvm_uffd_ops, it wouldn't be possible to register special VMAs with\nuserfaultfd.\n\nSince VM_SPECIAL includes VM_DONTEXPAND which is set but hugetlb, exclude\nhugetlb VMAs from the check for VM_SPECIAL."
    }
  ],
  "lastModified": "2026-08-23T13:16:34.650",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}