[PATCH 5.15.y v3 0/7] KVM: fixes for CVE-2026-46113 and related issues

[Kenta Akagi <k@mgml.me>]

This is a backport of the CVE-2026-46113 and CVE-2026-53359 fixes to 5.15.y.

The only difference from Paolo's v2 [1] is that commit ef057cbf825e ("KVM:
x86/mmu: Ensure hugepage is in by slot before checking max mapping level") is
not included, as it has already been backported to 5.15.y.

I believe v2 was not merged two months ago because of the regression reported
in [2], which occurs when only these patches are applied.

Commit a955cad84cda ("KVM: x86/mmu: Retry page fault if root is invalidated by
memslot update") was proposed as a fix for this regression. I have confirmed
that applying the v2 patches triggers the WARN, and that applying a955cad84cda
fixes it.

Since a955cad84cda has already been backported to 5.15.218, it is not included
in this series.

[1] https://lore.kernel.org/all/20260626174620.1819772-1-pbonzini@redhat.com/
[2] https://lore.kernel.org/kvm/20260630223723.83727-1-zcgao@amazon.com/ 

David Matlack (2):
  KVM: x86/mmu: Use a bool for direct
  KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root()

Paolo Bonzini (4):
  KVM: x86/mmu: Derive shadow MMU page role from parent
  KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes
  KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page()
  KVM: x86: Fix shadow paging use-after-free due to unexpected role

Sean Christopherson (1):
  KVM: x86: Fix shadow paging use-after-free due to unexpected GFN

 arch/x86/kvm/mmu/mmu.c         | 174 +++++++++++++++++++++------------
 arch/x86/kvm/mmu/paging_tmpl.h |  32 +++---
 arch/x86/kvm/mmu/spte.h        |   5 +
 3 files changed, 129 insertions(+), 82 deletions(-)

-- 
2.53.0