GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-63806

Vulnerability from fkie_nvd - Published: 2026-07-19 12:16 - Updated: 2026-08-17 05:17
Severity
7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Drop a BUG_ON() that has been reachable since it was first added, way back in 2009, and instead use get_unaligned() to perform potentially-unaligned accesses. For a given store, KVM x86's emulator tracks the entire value in the destination operand, x86_emulate_ctxt.dst. If the destination is memory, and the target splits multiple pages and/or is emulated MMIO, then KVM handles each fragment independently. E.g. on a page split starting at page offset 0xffc, KVM writes 4 bytes to the first page, then the remaining bytes to the second page, using ctxt->dst as the source for both (with appropriate offsets). If the destination splits a page *and* hits emulated MMIO on the second page, then KVM will complete the write to the first page, then emulate the MMIO access to the second page. If there is a datamatch-enabled ioeventfd at offset 0 of the second page, then KVM will process the remainder of the store as a potential ioeventfd signal. Putting it all together, if the guest emits a store that splits a page starting at page offset N, and the second page has a datamatch-enabled ioeventfd at offset 0, then KVM will check for datamatch using &dst.valptr[N] as the source. Due to dst (and thus dst.valptr) being 32-byte aligned, if N is not aligned to @len, the BUG_ON() fires. E.g. with a 16-byte store at page offset 0xffc, to an ioeventfd of len 8, all initial checks in ioeventfd_in_range() will succeed, and the BUG_ON() fires due to @val being 4-byte aligned, but not 8-byte aligned. ------------[ cut here ]------------ kernel BUG at arch/x86/kvm/../../../virt/kvm/eventfd.c:783! Oops: invalid opcode: 0000 [#1] SMP CPU: 0 UID: 1000 PID: 615 Comm: repro Not tainted 7.1.0-rc2-ff238429d1ea #365 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:ioeventfd_write+0x6c/0x70 [kvm] Call Trace: <TASK> __kvm_io_bus_write+0x85/0xb0 [kvm] kvm_io_bus_write+0x53/0x80 [kvm] vcpu_mmio_write+0x66/0xf0 [kvm] emulator_read_write_onepage+0x12a/0x540 [kvm] emulator_read_write+0x109/0x2b0 [kvm] x86_emulate_insn+0x4f8/0xfb0 [kvm] x86_emulate_instruction+0x181/0x790 [kvm] kvm_mmu_page_fault+0x313/0x630 [kvm] vmx_handle_exit+0x18a/0x590 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xc81/0x1c90 [kvm] kvm_vcpu_ioctl+0x2d5/0x970 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb7/0x890 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f19c931a9bf </TASK> Modules linked in: kvm_intel kvm irqbypass ---[ end trace 0000000000000000 ]--- In a perfect world, the fix would be to simply delete the BUG_ON(), as KVM x86 doesn't perform alignment checks on "normal" memory accesses at CPL0. Sadly, C99 ruins all the fun; while the x86 architecture plays nice, dereferencing an unaligned pointer directly is undefined behavior in C, e.g. triggers splats when running with CONFIG_UBSAN_ALIGNMENT=y.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2426c15c1395b7d5ccf1e5025ca898af7f3decb6Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/36ff44fb3d89960391e013fb9d91e23dbc48be47Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4186c850789906b875a1d263377a4d37c078e317Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5c87b47374682f69686068ad0a7779365a527b1cPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5da9b1a87ec7cc3489c27016313524769f12d9e0Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/92fc631b69deb1c7d56aec2663003600799dcd75Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bf89e3738480d33cd515b4a18900e8443d40cd2ePatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f1edbed787ba67988ed34e0132ca128b052b6ce8Patch
Impacted products
Vendor Product Version
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "virt/kvm/eventfd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2426c15c1395b7d5ccf1e5025ca898af7f3decb6",
              "status": "affected",
              "version": "d34e6b175e61821026893ec5298cc8e7558df43a",
              "versionType": "git"
            },
            {
              "lessThan": "4186c850789906b875a1d263377a4d37c078e317",
              "status": "affected",
              "version": "d34e6b175e61821026893ec5298cc8e7558df43a",
              "versionType": "git"
            },
            {
              "lessThan": "36ff44fb3d89960391e013fb9d91e23dbc48be47",
              "status": "affected",
              "version": "d34e6b175e61821026893ec5298cc8e7558df43a",
              "versionType": "git"
            },
            {
              "lessThan": "92fc631b69deb1c7d56aec2663003600799dcd75",
              "status": "affected",
              "version": "d34e6b175e61821026893ec5298cc8e7558df43a",
              "versionType": "git"
            },
            {
              "lessThan": "bf89e3738480d33cd515b4a18900e8443d40cd2e",
              "status": "affected",
              "version": "d34e6b175e61821026893ec5298cc8e7558df43a",
              "versionType": "git"
            },
            {
              "lessThan": "5da9b1a87ec7cc3489c27016313524769f12d9e0",
              "status": "affected",
              "version": "d34e6b175e61821026893ec5298cc8e7558df43a",
              "versionType": "git"
            },
            {
              "lessThan": "5c87b47374682f69686068ad0a7779365a527b1c",
              "status": "affected",
              "version": "d34e6b175e61821026893ec5298cc8e7558df43a",
              "versionType": "git"
            },
            {
              "lessThan": "f1edbed787ba67988ed34e0132ca128b052b6ce8",
              "status": "affected",
              "version": "d34e6b175e61821026893ec5298cc8e7558df43a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "virt/kvm/eventfd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.32"
            },
            {
              "lessThan": "2.6.32",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "515C38F6-B7B0-4E09-9245-51F5BD6ED6F1",
              "versionEndExcluding": "5.10.261",
              "versionStartIncluding": "2.6.32",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E99FB01-CD93-41AF-A653-3F450652B9A6",
              "versionEndExcluding": "5.15.212",
              "versionStartIncluding": "5.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "092233C7-F4E0-40C8-BD4D-A28FE50DFE20",
              "versionEndExcluding": "6.1.178",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7046B092-F810-4440-ACE6-60218518EECE",
              "versionEndExcluding": "6.6.145",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4E206B86-E0E3-4394-A93F-39F2D50A8AA8",
              "versionEndExcluding": "6.12.95",
              "versionStartIncluding": "6.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA591B28-5D62-449E-BDBE-3C9391BF070A",
              "versionEndExcluding": "6.18.38",
              "versionStartIncluding": "6.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9526B150-E2B3-4C6F-8AE5-1AF92B75AD9E",
              "versionEndExcluding": "7.1.3",
              "versionStartIncluding": "6.19",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()\n\nDrop a BUG_ON() that has been reachable since it was first added, way back\nin 2009, and instead use get_unaligned() to perform potentially-unaligned\naccesses.\n\nFor a given store, KVM x86\u0027s emulator tracks the entire value in the\ndestination operand, x86_emulate_ctxt.dst.  If the destination is memory,\nand the target splits multiple pages and/or is emulated MMIO, then KVM\nhandles each fragment independently.  E.g. on a page split starting at page\noffset 0xffc, KVM writes 4 bytes to the first page, then the remaining\nbytes to the second page, using ctxt-\u003edst as the source for both (with\nappropriate offsets).\n\nIf the destination splits a page *and* hits emulated MMIO on the second\npage, then KVM will complete the write to the first page, then emulate the\nMMIO access to the second page.  If there is a datamatch-enabled ioeventfd\nat offset 0 of the second page, then KVM will process the remainder of the\nstore as a potential ioeventfd signal.\n\nPutting it all together, if the guest emits a store that splits a page\nstarting at page offset N, and the second page has a datamatch-enabled\nioeventfd at offset 0, then KVM will check for datamatch using\n\u0026dst.valptr[N] as the source.  Due to dst (and thus dst.valptr) being\n32-byte aligned, if N is not aligned to @len, the BUG_ON() fires.\n\nE.g. with a 16-byte store at page offset 0xffc, to an ioeventfd of len 8,\nall initial checks in ioeventfd_in_range() will succeed, and the BUG_ON()\nfires due to @val being 4-byte aligned, but not 8-byte aligned.\n\n  ------------[ cut here ]------------\n  kernel BUG at arch/x86/kvm/../../../virt/kvm/eventfd.c:783!\n  Oops: invalid opcode: 0000 [#1] SMP\n  CPU: 0 UID: 1000 PID: 615 Comm: repro Not tainted 7.1.0-rc2-ff238429d1ea #365 PREEMPT\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  RIP: 0010:ioeventfd_write+0x6c/0x70 [kvm]\n  Call Trace:\n   \u003cTASK\u003e\n   __kvm_io_bus_write+0x85/0xb0 [kvm]\n   kvm_io_bus_write+0x53/0x80 [kvm]\n   vcpu_mmio_write+0x66/0xf0 [kvm]\n   emulator_read_write_onepage+0x12a/0x540 [kvm]\n   emulator_read_write+0x109/0x2b0 [kvm]\n   x86_emulate_insn+0x4f8/0xfb0 [kvm]\n   x86_emulate_instruction+0x181/0x790 [kvm]\n   kvm_mmu_page_fault+0x313/0x630 [kvm]\n   vmx_handle_exit+0x18a/0x590 [kvm_intel]\n   kvm_arch_vcpu_ioctl_run+0xc81/0x1c90 [kvm]\n   kvm_vcpu_ioctl+0x2d5/0x970 [kvm]\n   __x64_sys_ioctl+0x8a/0xd0\n   do_syscall_64+0xb7/0x890\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x7f19c931a9bf\n   \u003c/TASK\u003e\n  Modules linked in: kvm_intel kvm irqbypass\n  ---[ end trace 0000000000000000 ]---\n\nIn a perfect world, the fix would be to simply delete the BUG_ON(), as KVM\nx86 doesn\u0027t perform alignment checks on \"normal\" memory accesses at CPL0.\nSadly, C99 ruins all the fun; while the x86 architecture plays nice,\ndereferencing an unaligned pointer directly is undefined behavior in C,\ne.g. triggers splats when running with CONFIG_UBSAN_ALIGNMENT=y."
    }
  ],
  "id": "CVE-2026-63806",
  "lastModified": "2026-08-17T05:17:17.400",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 4.0,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-07-19T12:16:53.340",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/2426c15c1395b7d5ccf1e5025ca898af7f3decb6"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/36ff44fb3d89960391e013fb9d91e23dbc48be47"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/4186c850789906b875a1d263377a4d37c078e317"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/5c87b47374682f69686068ad0a7779365a527b1c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/5da9b1a87ec7cc3489c27016313524769f12d9e0"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/92fc631b69deb1c7d56aec2663003600799dcd75"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/bf89e3738480d33cd515b4a18900e8443d40cd2e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/f1edbed787ba67988ed34e0132ca128b052b6ce8"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-617"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.