From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0B2BE3F4106 for ; Fri, 26 Jun 2026 11:26:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782473201; cv=none; b=DYzJqpN88I2ggaiAQcVrWScXVQq491cGRBhXIrs1Y2Cu5HswDLVQuCVLZc/hSk5HD3wf82ogZhgFGTb6zoSJhS9HcVBQE512IHci8cPpD/PGMj2TpRv052AIJ1iCzeMcI3uUkbVKG72RsiUxWfwrKVaIvcMbow/uk9xFtpRjUGM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782473201; c=relaxed/simple; bh=qzFqL40tuVr5uJc4Z/ZoRpVEOvYkfO7gT1pHry4dH8I=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=eSSFlyPQiuDnZry/CfBLVNrhMOpUCVxWaVi9CNGWvKceWTZGU4BeGRstYDwMVITAcY85wWXjdq+b4LEvQFMyzSCgSkfs0cCEBYU0zvEbm8DCPeUXior4BamY3hxt1u/xYGIVQdiu2zDqMlZ1xBAI5lGgLgBds/dAMTENMGHOK2E= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=ha23pi5p; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=NJ6SCMkJ; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="ha23pi5p"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="NJ6SCMkJ" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1782473199; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=d960/iMXCVx2w6Xzf/sxVDFmfLPy0pQ94ged3XDQsPo=; b=ha23pi5p97xRjlJkp+IsQ1phb21O+DW8LxDxqDohPjZb63saqXogXzBW56kbDwM224AQzj DpddYcEKlCod7fOAr4ekJU7KpOS//9r7fB11BVlQCks9gp/GT6+YvIf3Ovr/o5UtfrRcFz 3RWYyonA0iwJRESOJCfbF1UpsHd7VYk= Received: from mail-wr1-f69.google.com (mail-wr1-f69.google.com [209.85.221.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-646-5ILW08DqPqexROC82eDE4g-1; Fri, 26 Jun 2026 07:26:37 -0400 X-MC-Unique: 5ILW08DqPqexROC82eDE4g-1 X-Mimecast-MFC-AGG-ID: 5ILW08DqPqexROC82eDE4g_1782473197 Received: by mail-wr1-f69.google.com with SMTP id ffacd0b85a97d-46d46a6d8d9so411546f8f.3 for ; Fri, 26 Jun 2026 04:26:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1782473196; x=1783077996; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to; bh=d960/iMXCVx2w6Xzf/sxVDFmfLPy0pQ94ged3XDQsPo=; b=NJ6SCMkJy+MtVou3k1vMC0vLtkkErV8pa3s6fVdEfeMfBG0IAWd3FsSoYwbbH1v3HY OkuITdN6Id20RK5ZLFCgAosaYTkp2CTjkeWNSgw1jnOvT7b2/+R/hEL58x7DRcX45g3l zM05UWDLEAYHve+WmYW6ooWpmmuaw7XP0luiCm8PPWHFoZddtP15eOfsG2xpQErCjh4A tLks2KFImKtASxBKNVTeeanisuPrpxKLozL/jNjmsSz4cuYTRjFlboJzA+YrDTL4oM6d bm2oUkhXYfQ12B3EcZPC/f7TTuNOhSCIxeMzNwSVf275dC4EX7nwA3BpWzkABaGzXDYH Bn1g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782473196; x=1783077996; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=d960/iMXCVx2w6Xzf/sxVDFmfLPy0pQ94ged3XDQsPo=; b=U1wtKN948GJgv1mFXmvUY+hJvpQRxi4qtHecWYsj2zhCEI/7isspAWWAXarZtBwn/I cR1SyytVWR1ZSlvkMy1MOpUwymu9cJY0GYB1eHZIYkEx14JgKypsoO7hfuyegs6umzHR U45ALTsJnEUwBlnw3KO7l8zRK4h5ee7f6cGhkVmuQ7BpWG1Don8XCaMU62W9Us/goxpv OB65Krwo0KdclQduFuZ8zaWJgikyy7kRMCHYx5iimBDHWgMCDpJPEsA3qBonkWaoIy5v KuRFeCr1kvlKjRzmkv4ciglk2tqadHgu09n+WsL0YB2QIp8qDylxLfYczYMnJpiO89pA cfEQ== X-Gm-Message-State: AOJu0Yx9M+uMg6OK/F+b8gImbhsMu/m0HKYoCtZUJt+2k2jnOHDNVSxd 8k/SZb35ODA8AtfRODlM4M2XNMc7ZOClY259b6Zi2H8k/w7DEWx2qNPfHCTf9Dv/KxTuySqd763 chDw2xuzJpeN6tsaWyfwhUo9AhtPIWj3jq+ERTXFxyANuciNENg4aQ0WYNBNI+fuMU64xiwX4n5 R0FQlE1FdO9HbYe6zErLAg7t8erTiXUDgd9B5auOHGGvqNgRJDUQ== X-Gm-Gg: AfdE7cmwJ3lO068NdL3iY7Q1QsGI8crYFFFLXRt7Q7xOTEz2NVA03aN6o2jnV+UHFDL 4L41koMiBMUIdHnC0c4yVmHbz4xOnzQeVLdGar61Yq7LavP9j9I8vKqsoBFCnKWVxkd9VqGtUtp XbdLwiMDQqPa1Tw5b/Rhzl0ZGcd4/z631YBbq8L+Q6Y5fgBsQUOWcDmuBTgBWztBfjkk0FtJP/z N18K3OKtyH7yF6P6pJxTlG191qn0YTEHP2ykDErNRz611owiInoq4UsPVpfInQsRtBNaJoNDW6A 1BJnMjmkuCrsW4A843Ge+aeDUrBWB8qFaL/V5XS/b4R5dybT/MgyeaTMwFJv/fj1XcKTbwRgevx Tq7iqKNZNsh0xfUQkuZaxd7/JomJCMAzF8hani8mj1tJMzQCI5miUkABNQ10hs1HvEp5kBfioy7 MgCB6DoiQk0UNeXx6X X-Received: by 2002:a05:600c:c4a5:b0:492:2e48:81e6 with SMTP id 5b1f17b1804b1-4926684a6b7mr94795565e9.4.1782473196559; Fri, 26 Jun 2026 04:26:36 -0700 (PDT) X-Received: by 2002:a05:600c:c4a5:b0:492:2e48:81e6 with SMTP id 5b1f17b1804b1-4926684a6b7mr94795045e9.4.1782473196050; Fri, 26 Jun 2026 04:26:36 -0700 (PDT) Received: from [192.168.10.48] ([151.95.124.208]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-46c2279b85csm22611955f8f.28.2026.06.26.04.26.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Jun 2026 04:26:35 -0700 (PDT) From: Paolo Bonzini To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 5.10.y 00/17] KVM: fixes for CVE-2026-46113 and related issues Date: Fri, 26 Jun 2026 13:26:17 +0200 Message-ID: <20260626112634.1778506-1-pbonzini@redhat.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sasha, Greg, this is the backport to 5.10 for the above CVE. Similar to 5.15, the fix was relatively simple upstream but only due to years of refactoring and cleaning up of the code; fixing from scratch is not really feasible so start by applying the patches that are needed. Paolo David Matlack (2): KVM: x86/mmu: Use a bool for direct KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() Lai Jiangshan (2): KVM: X86: Fix missed remote tlb flush in rmap_write_protect() KVM: X86: Synchronize the shadow pagetable before link it Paolo Bonzini (5): KVM: x86/mmu: Derive shadow MMU page role from parent KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() KVM: x86: Fix shadow paging use-after-free due to unexpected role Sean Christopherson (9): KVM: x86/mmu: Capture 'mmu' in a local variable when allocating roots KVM: x86/mmu: Allocate the lm_root before allocating PAE roots KVM: x86/mmu: Allocate pae_root and lm_root pages in dedicated helper KVM: x86/mmu: Ensure MMU pages are available when allocating roots KVM: x86/mmu: Refactor shadow walk in __direct_map() to reduce indentation KVM: x86/mmu: Check PDPTRs before allocating PAE roots KVM: x86: Fix shadow paging use-after-free due to unexpected GFN KVM: x86/mmu: Pass the memslot to the rmap callbacks KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level arch/x86/kvm/mmu/mmu.c | 431 ++++++++++++++++++++------------- arch/x86/kvm/mmu/paging_tmpl.h | 72 +++--- arch/x86/kvm/mmu/spte.h | 5 + arch/x86/kvm/mmu/tdp_mmu.c | 23 +- arch/x86/kvm/vmx/vmx_ops.h | 3 +- include/linux/kvm_host.h | 5 + 6 files changed, 308 insertions(+), 231 deletions(-) -- 2.54.0