SB2026072122 - Reachable assertion in Linux kernel kvm

Description

This security bulletin contains information about 1 vulnerability.

1) Reachable assertion (CVE-ID: CVE-2026-63806)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an improper handling of unaligned memory access in ioeventfd datamatch handling in KVM when processing a guest store that splits a page and targets emulated MMIO with a datamatch-enabled ioeventfd. A local user can trigger a specially crafted guest store operation to cause a denial of service.

Exploitation requires a guest configuration where the second page contains a datamatch-enabled ioeventfd at offset 0.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/5c87b47374682f69686068ad0a7779365a527b1c
• https://git.kernel.org/stable/c/5da9b1a87ec7cc3489c27016313524769f12d9e0
• https://git.kernel.org/stable/c/bf89e3738480d33cd515b4a18900e8443d40cd2e
• https://git.kernel.org/stable/c/f1edbed787ba67988ed34e0132ca128b052b6ce8