[SRU][N:hwe-6.17][PATCH 0/1] CVE-2026-46113

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-46113

[ Impact ]

The KVM x86 shadow MMU computed GFNs for direct shadow pages from sp->gfn
plus the SPTE index, which breaks if the guest modifies its page tables
between VM entries. kvm_mmu_get_child_sp() would reuse a present, non-large
SPTE's child shadow page without checking the GFN, leaving a stale child
shadow page that is later freed and used again. A guest can drive this
use-after-free.

[ Fix ]

noble/linux-hwe-6.17: clean cherry-pick

[ Test Plan ]

Build tested only (CBD).

[ Where Problems Could Occur ]

The change is in the x86 KVM shadow MMU child shadow-page linking path
(arch/x86/kvm/mmu/mmu.c); it rewrites __link_shadow_page() to zap a present
non-leaf SPTE properly. A mistake could affect shadow or nested paging
guests. This is a clean pick of the upstream fix.