CVE-2026-64561

This is a KVM shadow MMU vulnerability where the timeline is more nuanced than the CVE date suggests. The code pattern dates to 2008, but it wasn't a vulnerability until Linux 5.9 introduced a security invariant: invalid pages cannot reside on active MMU page lists. The 2020 commit that established this invariant retroactively exposed a latent issue in code that was previously safe. This matters practically—you shouldn't treat this as 18 years of unpatched vulnerability. The exploitable condition only existed from 5.9 onward, roughly five years. The more pressing concern is the partial fix. The current patch reorders a check to prevent populating an invalid root, but there's a second, unfixed flaw: child shadow pages can inherit an invalid role from their parent. The disclosure explicitly defers this to a separate fix. That language should concern you. It means the invariant violation is still occurring in production through an orthogonal code path—one the current patch doesn't touch. You now have a CVSS 8.8-rated exploitable path that is patched, coexisting with an unpatched invariant violation that has no CVSS, no severity rating, and no public remediation timeline. For your risk modeling: treat this as two concurrent exposure windows, not one patched vulnerability. Monitor the KVM mailing list for the follow-on fix addressing role.invalid inheritance—that's your second vulnerability, even without a CVE number yet. If you're doing threat hunting, the unpatched invariant violation path is likely lower-complexity to exploit than the now-mitigated primary path, since it doesn't require the specific trigger the current patch blocks. Assume an attacker who knows about both paths has a Plan B if your systems are already patched for the primary issue.

Reviewed through automated stages and approved by a human before publication.