APPLIED: [SRU][N:hwe-6.17][PATCH 0/1] CVE-2026-53359

[Edoardo Canepa]

Applied to n:linux/hwe-6.17-next. Thanks.

On 7/22/26 19:03, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-53359
>
> [ Impact ]
>
> A second use-after-free in the same KVM x86 shadow MMU path. When
> kvm_mmu_get_child_sp() found a present, non-large SPTE it reused the child
> shadow page without checking the page role, so a guest could attach a
> shadow page under a mismatched role and leave a stale child shadow page
> that is later freed and used again.
>
> [ Fix ]
>
> noble/linux-hwe-6.17: clean cherry-pick
>
> This fix depends on the CVE-2026-46113 fix (commit 0cb2af2ea66ad, "KVM:
> x86: Fix shadow paging use-after-free due to unexpected GFN"), sent
> separately, which must be applied first. That commit rewrites
> __link_shadow_page() to zap a present non-leaf SPTE; without it, applying
> this role check alone would trade one use-after-free for another.
>
> [ Test Plan ]
>
> Build tested only (CBD).
>
> [ Where Problems Could Occur ]
>
> The change is in the x86 KVM shadow MMU (arch/x86/kvm/mmu/mmu.c), the child
> shadow-page linking path. A mistake could affect shadow or nested paging
> guests. This is a clean pick of the upstream fix.
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0x20F88172E14F6784.asc
Type: application/pgp-keys
Size: 3167 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260723/71c7bd48/attachment.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260723/71c7bd48/attachment.sig>