Re: [PATCH 5.15.y v4 00/11] KVM: fixes for CVE-2026-46113 and related issues

[Sean Christopherson]

On Tue, Sep 29, 2026, Kenta Akagi wrote:
> This is a backport of the CVE-2026-46113 and CVE-2026-53359 fixes to 5.15.y.
> 
> v2: https://lore.kernel.org/all/20260626174620.1819772-1-pbonzini@xxxxxxxxxx/
> v3: https://lore.kernel.org/stable/20260913155523.7423-1-k@xxxxxxx/
> 
> Changes from v3:
> - Added patches 3-6 to backport the change from gpte_is_8_bytes to has_4_byte_gpte.
> - Adjusted patches 7-8 (patches 3/7 and 4/7 in v3) accordingly.
> 
> A regression has been reported in the backport of commit 0cb2af2ea66a
> ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN")
> [1], but the corresponding fix has already been merged into 5.15.218 [2].
> 
> [1] https://lore.kernel.org/kvm/20260630223723.83727-1-zcgao@xxxxxxxxxx/
> [2] https://lore.kernel.org/stable/20260825132543.573783299@xxxxxxxxxxxxxxxxxxx/
> 
> David Matlack (2):
>   KVM: x86/mmu: Use a bool for direct
>   KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root()
> 
> Lai Jiangshan (3):
>   KVM: X86: Remove useless code to set role.gpte_is_8_bytes when
>     role.direct
>   KVM: X86: Calculate quadrant when !role.gpte_is_8_bytes
>   KVM: X86: Rename gpte_is_8_bytes to has_4_byte_gpte and invert the
>     direction
> 
> Paolo Bonzini (5):
>   KVM: MMU: update comment on the number of page role combinations
>   KVM: x86/mmu: Derive shadow MMU page role from parent
>   KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes
>   KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page()
>   KVM: x86: Fix shadow paging use-after-free due to unexpected role
> 
> Sean Christopherson (1):
>   KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
> 
>  Documentation/virt/kvm/mmu.rst  |   8 +-
>  arch/x86/include/asm/kvm_host.h |  32 +++---
>  arch/x86/kvm/mmu/mmu.c          | 184 ++++++++++++++++++++------------
>  arch/x86/kvm/mmu/mmutrace.h     |   2 +-
>  arch/x86/kvm/mmu/paging_tmpl.h  |  32 +++---
>  arch/x86/kvm/mmu/spte.h         |   5 +
>  arch/x86/kvm/mmu/tdp_mmu.c      |   2 +-
>  7 files changed, 159 insertions(+), 106 deletions(-)

With the disclaimer that I didn't do extensive testing...

Acked-by: Sean Christopherson <seanjc@xxxxxxxxxx>