Incorrect comparison in Linux kernel - CVE-2026-99082

Vulnerability details

The vulnerability allows a local user to bypass KVM's write tracking for guest RAM and cause continued use of stale guest memory translations.

The vulnerability exists due to incorrect memslot generation comparisons in the x86 KVM per-vCPU MMIO cache when caching and validating entries across normal and system management mode address spaces. A local user can cause a stale cache entry to misclassify a valid guest RAM access as KVM_EXIT_MMIO after an SMM memslot update, allowing completion through the virtual machine monitor's RAM address space to bypass write tracking and leave shadow translations stale if the modified page backs a nested EPT table.

Affected software

How to mitigate CVE-2026-99082

External References

• https://git.kernel.org/stable/c/2566780c684c9c21241d409d790087c73070f312
• https://git.kernel.org/stable/c/7fd4e64f4bbc8c35ae8f0d2a1fb5b77a76d5b4fd
• https://git.kernel.org/stable/c/a63f79d9da9468952396af73e1e53330845cf876
• https://git.kernel.org/stable/c/b3e6212dea2e4328a841ceb37f377583176dc735
• https://git.kernel.org/stable/c/e792a9ace39d2812a5b342a1987186c7bc653204

Related Security Bulletins

• Incorrect comparison in Linux kernel x86 kvm
• Debian update for linux