VulnSocial

CVE-2026-80726Disclosure

MEDIUMCVSS 9.3 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page Explicitly clear role.invalid when deriving a child shadow page's role from its parent to harden against bugs elsewhere in KVM, as violating KVM's invariant that invalid pages are NOT on the list of active MMU pages leads to use-after-free due to __kvm_mmu_prepare_zap_page() using list_add() instead of list_move() when processing an invalid shadow page, i.e. makes a bad situation far worse. Yell loudly if the parent is invalid, as it means KVM has missed a validity check, i.e. KVM is attempting to map memory using an invalid/obsolete root, but continue on as the child is otherwise still a valid shadow page. ================================================================== BUG: KASAN: slab-use-after-free in __kvm_mmu_get_shadow_page+0x1817/0x1860 [kvm] Write of size 8 at addr ff11000153dd1368 by task repro/853 CPU: 1 UID: 1000 PID: 853 Comm: repro Not tainted 7.2.0-rc2-3aec122bdcaf-next-vm #5 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl+0x4b/0x70 print_report+0x153/0x49c kasan_report+0xbc/0xf0 __kvm_mmu_get_shadow_page+0x1817/0x1860 [kvm] mmu_alloc_root+0x141/0x320 [kvm] kvm_mmu_load+0x612/0x20f0 [kvm] kvm_arch_vcpu_ioctl_run+0x3dd5/0x6150 [kvm] kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm] __x64_sys_ioctl+0x131/0x1b0 do_syscall_64+0x67/0x5f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> Allocated by task 853: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x5f/0x70 kmem_cache_alloc_noprof+0xfe/0x2e0 __kvm_mmu_topup_memory_cache+0x135/0x530 [kvm] paging64_page_fault+0x318/0x1e30 [kvm] kvm_mmu_do_page_fault+0x21d/0x630 [kvm] kvm_mmu_page_fault+0x18c/0x17b0 [kvm] kvm_arch_vcpu_ioctl_run+0x1f35/0x6150 [kvm] kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm] __x64_sys_ioctl+0x131/0x1b0 do_syscall_64+0x67/0x5f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Freed by task 853: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x43/0x70 kmem_cache_free+0xe2/0x400 kvm_mmu_commit_zap_page.part.0+0x1e2/0x310 [kvm] kvm_mmu_free_roots+0x283/0x560 [kvm] kvm_arch_vcpu_ioctl_run+0x33c8/0x6150 [kvm] kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm] __x64_sys_ioctl+0x131/0x1b0 do_syscall_64+0x67/0x5f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-09-04); latest day: 1
  • 4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-09-03: 1Mentions · 2026-09-04: 2Mentions · 2026-09-25: 1Active Exploitation · 2026-09-25: 1Patch / Workaround · 2026-09-04: 2Patch / Workaround · 2026-09-25: 1Technical Details · 2026-09-04: 209-0309-0409-25
Signal classification3 categories
Disclosure
250.0%
Patch
125.0%
Active Exploitation
125.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-031
Disclosure1
2026-09-042
Disclosure1Patch1
2026-09-251
Active Exploitation1
Full discourse4 posts
  • Rıdvan Yağlı@ridvanyagli
    Disclosure

    🔴 Linux Kernel'de KVM'i etkileyen kritik güvenlik açığı: CVE-2026-80726 Linux'un KVM sanallaştırma altyapısında bulunan açık, x86 MMU (bellek yönetimi) mekanizmasındaki bir hatadan kaynaklanıyor. CVSS: 9.3 Hata, belirli durumlarda serbest bırakılmış belleğe yeniden erişilmesine (Use-After-Free) yol açabiliyor. Bu tür bellek hataları; sistem çökmesi, bellek bozulması ve potansiyel olarak daha ciddi güvenlik sorunlarına neden olabilir. 📌 CVE-2026-80726, 3 Eylül 2026'da yayınlandı. 📌 Upstream düzeltmeleri 6.1.183, 6.6.152, 6.12.104, 6.18.45 ve 7.1.9 sürümlerinde yer alıyor. 📌 KVM/QEMU tabanlı sanallaştırma altyapılarını etkiliyor. KVM kullanan VPS ve fiziksel sunucu yöneticilerinin kernel güncellemelerini takip etmesi öneriliyor.

    Post summary

    The announcement details CVE-2026-80726, a use‑after‑free vulnerability in KVM’s x86 MMU, with a CVSS score of 9.3, and lists kernel releases that contain the upstream patch.

    01040479
    2.4K followersView on X
  • Vlad the Installer@itimorin
    Active Exploitation

    Linux 7.1 is dead. EOL'd Sept 2 after 3 months. 188 CVEs dropped last week alone (CVE-2026-80726–80913). CISA gave feds 72hrs to patch 3 actively exploited kernel flaws. Dirty Frag (CVE-2026-43284/43500) is Copy Fail's nastier cousin. Still on 7.1? You're not running a kernel. You're running a liability. 🐧☠️

    Post summary

    The post warns that Linux 7.1 is end-of-life and notes a batch of CVEs, emphasizing that three kernel flaws are actively exploited, prompting CISA to order federal patching within 72 hours.

    0000053
    83 followersView on X
  • Arnaud Wallon@arwallon
    Patch

    CVE-2026-80726 : une faille critique dans KVM menace les machines virtuelles Linux Une faille critique (9,3/10) dans KVM, le composant de virtualisation du noyau Linux, permet une évasion de machine virtuelle. Le correctif est déjà disponible, voici quoi faire. https://numeribrain.com/posts/cve-2026-80726-faille-critique-kvm-noyau-linux

    Post summary

    The post announces a critical KVM VM‑escape vulnerability (CVE‑2026‑80726), notes a 9.3/10 severity, and confirms a patch is already available with remediation instructions.

    0000038
    359 followersView on X
  • VulDB 🛡@vuldb
    Disclosure

    A new vulnerability with increased severity was disclosed for Linux Kernel (CVE-2026-80726) https://vuldb.com/vuln/398322

    Post summary

    The text announces the disclosure of CVE-2026-80726, a newer Linux Kernel vulnerability identified with increased severity, without providing further technical or mitigation details.

    00000141
    2.3K followersView on X

Explore more

Back to dashboard