Reachable assertion in Linux kernel - CVE-2026-63806

Vulnerability identifier: #VU138846

CSH Severity: Low

CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-63806

CWE-ID: CWE-617

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an improper handling of unaligned memory access in ioeventfd datamatch handling in KVM when processing a guest store that splits a page and targets emulated MMIO with a datamatch-enabled ioeventfd. A local user can trigger a specially crafted guest store operation to cause a denial of service.

Exploitation requires a guest configuration where the second page contains a datamatch-enabled ioeventfd at offset 0.

Linux kernel
SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME
SUSE Linux Enterprise Server 11
Ubuntu
kernel-ec2-debugsource
kernel-docs
kernel-xen
kernel-default
kernel-trace
kernel-ec2
kernel-syms
kernel-ec2-debuginfo
kernel-trace-devel-debuginfo
kernel-source
kernel-xen-debuginfo
kernel-default-devel-debuginfo
kernel-default-devel
kernel-ec2-devel
kernel-xen-devel
kernel-default-debugsource
kernel-xen-debugsource
kernel-ec2-devel-debuginfo
kernel-trace-base
kernel-trace-debuginfo
kernel-xen-base
kernel-ec2-base
kernel-xen-devel-debuginfo
kernel-default-debuginfo
kernel-trace-devel
kernel-default-base
kernel-trace-debugsource
linux (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel-ec2-debugsource - update to 3.0.101-108.216.1
kernel-docs - update to 3.0.101-108.216.1
kernel-xen - update to 3.0.101-108.216.1
kernel-default - update to 3.0.101-108.216.1
kernel-trace - update to 3.0.101-108.216.1
kernel-ec2 - update to 3.0.101-108.216.1
kernel-syms - update to 3.0.101-108.216.1
kernel-ec2-debuginfo - update to 3.0.101-108.216.1
kernel-trace-devel-debuginfo - update to 3.0.101-108.216.1
kernel-source - update to 3.0.101-108.216.1
kernel-xen-debuginfo - update to 3.0.101-108.216.1
kernel-default-devel-debuginfo - update to 3.0.101-108.216.1
kernel-default-devel - update to 3.0.101-108.216.1
kernel-ec2-devel - update to 3.0.101-108.216.1
kernel-xen-devel - update to 3.0.101-108.216.1
kernel-default-debugsource - update to 3.0.101-108.216.1
kernel-xen-debugsource - update to 3.0.101-108.216.1
kernel-ec2-devel-debuginfo - update to 3.0.101-108.216.1
kernel-trace-base - update to 3.0.101-108.216.1
kernel-trace-debuginfo - update to 3.0.101-108.216.1
kernel-xen-base - update to 3.0.101-108.216.1
kernel-ec2-base - update to 3.0.101-108.216.1
kernel-xen-devel-debuginfo - update to 3.0.101-108.216.1
kernel-default-debuginfo - update to 3.0.101-108.216.1
kernel-trace-devel - update to 3.0.101-108.216.1
kernel-default-base - update to 3.0.101-108.216.1
kernel-trace-debugsource - update to 3.0.101-108.216.1
linux (Ubuntu package) - addressed in versions 7.0.0-31.31, 7.0.0-31.31.1, 7.0.0-31.31~24.04.1, 7.0.0-1006.7, 7.0.0-1011.11~24.04.1, 7.0.0-1012.12, 7.0.0-1012.12~24.04.1
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1013.13

• https://git.kernel.org/stable/c/5c87b47374682f69686068ad0a7779365a527b1c
• https://git.kernel.org/stable/c/5da9b1a87ec7cc3489c27016313524769f12d9e0
• https://git.kernel.org/stable/c/bf89e3738480d33cd515b4a18900e8443d40cd2e
• https://git.kernel.org/stable/c/f1edbed787ba67988ed34e0132ca128b052b6ce8

• Reachable assertion in Linux kernel kvm
• SUSE update for the Linux Kernel
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux
• Ubuntu update for linux-gcp-7.0