SB2026050949 - Improper input validation in Linux kernel uapi linux

Description

This security bulletin contains information about 1 vulnerability.

1) Improper input validation (CVE-ID: CVE-2026-43348)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the mshv_vtl VTL0 memory registration logic when handling a crafted MSHV_ADD_VTL0_MEMORY request. A local user can register a sufficiently aligned memory range to cause a denial of service.

The issue is triggered when the computed vmemmap_shift exceeds MAX_FOLIO_ORDER, causing memremap_pages() to emit a warning and fail with -EINVAL.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/404cd6bffe17e25e0f94ed2775ffdd6cd10ac3fd
• https://git.kernel.org/stable/c/a142ca4b6481e71498712800b20e0c0fcf02843b