From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 30A9719DF6A for ; Fri, 26 Jun 2026 17:46:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782495988; cv=none; b=FVL/+mzLm9tuBujoQFVii6GLawaD/xlGDry6y8PHCRZJ8h1MsGx92Rat+FdVEDXgUwD0kmdMk/gtDpfn7e2ssdt8J0ebZch8nCzz1+16O33l6o6keoAedbC/O4M/Q5t5wEjzqKlX8OlLFZG2DaEI+i4N8dyk2jcDgKS2im2VwzU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782495988; c=relaxed/simple; bh=J8aIGZigHML28IHFefYArVN5OECpup/t70vEj4gkDGY=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=ItRel3yCGE1Lgbup+G/DeCzkmVlctKoFTUCX5mIgDWap9299gNBXMDTMifs3PJe1xLoecrNoPP/xZqBUTrO8CaEFm9N5TsIHikt+on2CDN7TgoGML4I9w0qNRe6Smjo47ua3a5b6VafoxN4NfnnR0/uHN67JNCpk69bN4r2ushc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=QtdE7VI+; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=KUyzm7CT; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="QtdE7VI+"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="KUyzm7CT" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1782495985; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=J+LmZwe12CEjv/lR2veCJq0GatrkSSylTfQwITNGjHM=; b=QtdE7VI+1A9ouF1NLT2eifwJc70YtbDt9O9P7JAMr5kJGvkP1xl1wbSknpdIph1LEy9cH+ QkMO7q4ySxUmpGTCpL/tjECObB74s7t7PPxbb/5pjcNREm14itQ5ki22mSCbRW6bL6smUl GGyqitv96bLUpGmfSX7IwGSvcXy2vXQ= Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-158-P5csxKHONN2OcLg8VowM6A-1; Fri, 26 Jun 2026 13:46:23 -0400 X-MC-Unique: P5csxKHONN2OcLg8VowM6A-1 X-Mimecast-MFC-AGG-ID: P5csxKHONN2OcLg8VowM6A_1782495983 Received: by mail-wr1-f70.google.com with SMTP id ffacd0b85a97d-46c3018dd9eso782218f8f.3 for ; Fri, 26 Jun 2026 10:46:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1782495982; x=1783100782; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to; bh=J+LmZwe12CEjv/lR2veCJq0GatrkSSylTfQwITNGjHM=; b=KUyzm7CTMY524u8+YfokQo/fJSbcQTA9FsljO2hn1hvW3/0dTayff718QikiM6PXsi CDm6uKhT+3ZQMZGxUHE3eyf9FMLgtck/QvEVrU69ObMBkaWZ6ONReSbvG6PiIoTx80u8 GZ4DKZYBrUfDgcY0fRT6gW1fc5FSTpcjI4m6K41AzN/OJAVpk4xJko0iS425lwGGYJOf +7GJ2uW0hy0GWI0tlWS4npVw/HcZjAtB/y2Fzs8kOs5sbL5LL9l4Q1EvKtMFB01cMlYk VgTRMBsrJ2PfFLZ6xMLG0pM+c1EeqvnnYD1CLyL5mQH2ABSLOO1rstnErw8nsM/IG4Rg meOA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782495982; x=1783100782; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=J+LmZwe12CEjv/lR2veCJq0GatrkSSylTfQwITNGjHM=; b=lprmGvBrMGWF8C43aEJsguMJveMecRGMdRjNUiOKkfZXBd4w4WCFRCQhoUqA9i14Cf v+5BaU5fhDxK4KjUmo+c7XxttBEtTPtddBYXTDSMDvsILQy+96vQMPfDunOzXzqdQ/MQ 9bMv3xgPLHaAqxQo5cS5GmyHRGLSLLs6pVnZj0067SCxVDGo9FS3LcOhJ1HiNbcVAvl/ yVm2BZZE8Kw44yOWmZMKnepd5O+VK7f2sJwAGdPWRS5D2gNUKRKFfr9vt1Yuj+/Vm32T KOWET21d+94nqiw8DsY/43GJUb1Xq2ETXj6LAtjz5ZtpWCClQGxHsy22Ryjn6eZdSX58 6TeQ== X-Gm-Message-State: AOJu0Yz8zGEv+2G6yhsccMgrzj4C6Al+pBsBV8ox1G7d/6qJAtQMObry zcIOP6QQaOEpCCDTDxjoA+t23eCNXpc8DpqAxXUci2aeMCwYgEUn0VAiOiC2XGZwtmQcNOnctii MrpyQV/orf93sDkgAXtW3yTz7A+/C5yAP7iCj36QzAPjlG8L3oyKFCdeMbi9oSBUYngKMs3POI+ 1hXvFcicPzW3v9DjdAkzkBZz6bTsA9zAezOu8VUA2b305a5nYYLA== X-Gm-Gg: AfdE7cmoFX2YpaaW6906E18GkZTDNsQJoEGQKs+qq3vYsrYCjECdN6JC/VT4GMdGS2t +Zz2esw3p2mFqj/dyIFYKLoEw+Ur6DrWwGD+ZxjJfSX7LiOvCY+2EoLOtb01tG/e9NhUQIRrYqV Fzyda/tXSG5cE3d0MXjQDNax5OXUyw2MpOwJAVydoi0lp0091IZA0O/LgdDSh8vyHyAmHTMIalH yVtsZqrD0QKHcNlpIJwX0l2eBbHHT9ajFvYl+ihTy7ZM7C3V0jLBRPq3gAe8Y3FlDClpyw/zy/P Os71asADxr0C81EEij7bp2/s7FWDL+h/REPjoM9qmSKWKaBsPL/ZnllsgzbwpHnGSwTfY5EXKK+ oYlA3GzOXI+um/v/UM+yTiZABFe71umo4n9iO8AtjA80iEEe1UHK/eMBCZCmLVmlxcHc6W+aYZ5 M23hGe8FAkOPavNpmJ X-Received: by 2002:a05:6000:230a:b0:461:a1fd:6be with SMTP id ffacd0b85a97d-46dbef25978mr12605902f8f.7.1782495982605; Fri, 26 Jun 2026 10:46:22 -0700 (PDT) X-Received: by 2002:a05:6000:230a:b0:461:a1fd:6be with SMTP id ffacd0b85a97d-46dbef25978mr12605860f8f.7.1782495982120; Fri, 26 Jun 2026 10:46:22 -0700 (PDT) Received: from [192.168.10.48] ([151.95.124.208]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-46c2279bc77sm25475862f8f.32.2026.06.26.10.46.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Jun 2026 10:46:21 -0700 (PDT) From: Paolo Bonzini To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 5.15.y v2 0/8] KVM: fixes for CVE-2026-46113 and related issues Date: Fri, 26 Jun 2026 19:46:11 +0200 Message-ID: <20260626174620.1819772-1-pbonzini@redhat.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sasha, Greg, this is the backport to 5.15 for the above CVE. The fix was relatively simple upstream but only due to years of refactoring and cleaning up of the code; fixing from scratch is not really feasible so start by applying the patches that are needed. Please apply this instead of v1, due to a missing line in the last patch. Sorry about that. Paolo David Matlack (2): KVM: x86/mmu: Use a bool for direct KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() Paolo Bonzini (5): KVM: x86/mmu: Derive shadow MMU page role from parent KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() KVM: x86: Fix shadow paging use-after-free due to unexpected role Sean Christopherson (2): KVM: x86: Fix shadow paging use-after-free due to unexpected GFN KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level arch/x86/kvm/mmu/mmu.c | 192 +++++++++++++++++++++------------ arch/x86/kvm/mmu/paging_tmpl.h | 30 +++--- arch/x86/kvm/mmu/spte.h | 5 + arch/x86/kvm/vmx/vmx_ops.h | 3 +- include/linux/kvm_host.h | 7 +- 5 files changed, 147 insertions(+), 90 deletions(-) -- 2.54.0