CVE-2026-43348
Memory Corruption in Linux Kernel via vmemmap_shift
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's mshv_vtl component when registering VTL0 memory. The kernel calculates a value called vmemmap_shift based on the alignment of memory page frame numbers (start_pfn and last_pfn). However, this value is not limited to a maximum allowed size (MAX_FOLIO_ORDER). If the memory range is highly aligned, the calculated shift can exceed what the kernel's memremap_pages() function supports, causing a warning and an error (-EINVAL).
The issue was fixed by clamping the vmemmap_shift value to MAX_FOLIO_ORDER, ensuring the kernel only requests supported page sizes. Additionally, the error handling was improved to propagate the correct error code instead of masking it.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to trigger warnings and fail to register certain memory ranges properly due to unsupported page size requests. This results in errors during memory registration, which could lead to failures in memory management operations involving VTL0 memory in the mshv_vtl component.
Such failures might impact system stability or functionality when using this specific memory registration feature, potentially causing disruptions or degraded performance in environments relying on this kernel functionality.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the system logs for specific warning messages related to memremap_pages failures.
Look for kernel warnings similar to the following in your system logs (e.g., dmesg or /var/log/kern.log):
- WARNING: ... memremap_pages+0x512/0x650 requested folio size unsupported
You can use the following command to search for such warnings in the kernel ring buffer:
- dmesg | grep memremap_pages
Or to search in persistent logs:
- grep memremap_pages /var/log/kern.log
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by clamping the vmemmap_shift value to MAX_FOLIO_ORDER in the Linux kernel code, preventing out-of-range requests.
Immediate mitigation steps include:
- Update your Linux kernel to a version that includes the fix for this vulnerability.
- Monitor system logs for warnings related to memremap_pages to detect any attempts to trigger this issue.
- Avoid registering VTL0 memory ranges that are excessively aligned and could trigger the issue until the kernel is updated.