ACK: [SRU][N:hwe-6.17][PATCH 0/1] CVE-2026-46113

[Alessio Faina]

On Wed, Jul 22, 2026 at 08:02:55PM +0300, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-46113
> 
> [ Impact ]
> 
> The KVM x86 shadow MMU computed GFNs for direct shadow pages from sp->gfn
> plus the SPTE index, which breaks if the guest modifies its page tables
> between VM entries. kvm_mmu_get_child_sp() would reuse a present, non-large
> SPTE's child shadow page without checking the GFN, leaving a stale child
> shadow page that is later freed and used again. A guest can drive this
> use-after-free.
> 
> [ Fix ]
> 
> noble/linux-hwe-6.17: clean cherry-pick
> 
> [ Test Plan ]
> 
> Build tested only (CBD).
> 
> [ Where Problems Could Occur ]
> 
> The change is in the x86 KVM shadow MMU child shadow-page linking path
> (arch/x86/kvm/mmu/mmu.c); it rewrites __link_shadow_page() to zap a present
> non-leaf SPTE properly. A mistake could affect shadow or nested paging
> guests. This is a clean pick of the upstream fix.
> 
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team

Acked-by: Alessio Faina <alessio.faina at canonical.com>