Live › vulnerability › CVE-2026-99168
Go to dashboardIn the Linux kernel's mshv_vtl driver, a CPU whose register page failed to set up can still be reached through a memory fault, leading to a NULL pointer passed to get_page(). The fix checks the per-CPU register page before taking its reference and returns a bus error when it is missing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Only systems running the Linux kernel with the mshv_vtl driver, which is used for Microsoft Hyper-V VTL (virtual trust level) guests. The sources do not state whether ordinary Linux hosts or guests load this driver, so unknown for general systems. Mixed register-page setup across online CPUs is required to hit the flaw.
No product ranges from the sources yet.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
mshv_vtl: Check per-CPU register page before mmap
Register-page setup is optional for each CPU. If allocation or registration fails, mshv_vtl_configure_reg_page() warns and leaves that CPU's reg_page NULL, but initial context setup continues successfully. Meanwhile, successful setup on another CPU sets the global mshv_has_reg_page flag.
mshv_vtl_fault() checks this global flag before selecting the requested CPU's register page. With mixed setup results across online CPUs, the check passes even for a CPU with no register page, reaching get_page(NULL) when userspace faults in that mapping.
Check the selected per-CPU register page before taking its reference and return VM_FAULT_SIGBUS if it is absent.
This page as .md · .json · in your agent: get_signal("CVE-2026-99168")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.