[SRU][N:hwe-6.17][PATCH 0/1] CVE-2026-53359

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-53359

[ Impact ]

A second use-after-free in the same KVM x86 shadow MMU path. When
kvm_mmu_get_child_sp() found a present, non-large SPTE it reused the child
shadow page without checking the page role, so a guest could attach a
shadow page under a mismatched role and leave a stale child shadow page
that is later freed and used again.

[ Fix ]

noble/linux-hwe-6.17: clean cherry-pick

This fix depends on the CVE-2026-46113 fix (commit 0cb2af2ea66ad, "KVM:
x86: Fix shadow paging use-after-free due to unexpected GFN"), sent
separately, which must be applied first. That commit rewrites
__link_shadow_page() to zap a present non-leaf SPTE; without it, applying
this role check alone would trade one use-after-free for another.

[ Test Plan ]

Build tested only (CBD).

[ Where Problems Could Occur ]

The change is in the x86 KVM shadow MMU (arch/x86/kvm/mmu/mmu.c), the child
shadow-page linking path. A mistake could affect shadow or nested paging
guests. This is a clean pick of the upstream fix.