{"id":"CVE-2026-99168","kind":"vulnerability","aliases":["CVE-2026-99168"],"related":[],"title":"Linux kernel: mshv_vtl mmap path can dereference a NULL register page","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmshv_vtl: Check per-CPU register page before mmap\n\nRegister-page setup is optional for each CPU. If allocation or\nregistration fails, mshv_vtl_configure_reg_page() warns and leaves that\nCPU's reg_page NULL, but initial context setup continues successfully.\nMeanwhile, successful setup on another CPU sets the global\nmshv_has_reg_page flag.\n\nmshv_vtl_fault() checks this global flag before selecting the requested\nCPU's register page. With mixed setup results across online CPUs, the\ncheck passes even for a CPU with no register page, reaching\nget_page(NULL) when userspace faults in that mapping.\n\nCheck the selected per-CPU register page before taking its reference and\nreturn VM_FAULT_SIGBUS if it is absent.","summary":"In the Linux kernel's mshv_vtl driver, a CPU whose register page failed to set up can still be reached through a memory fault, leading to a NULL pointer passed to get_page(). The fix checks the per-CPU register page before taking its reference and returns a bus error when it is missing.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hyper-v","linux-kernel","mshv-vtl","runtime"],"not_affected_if":["no-mshv-vtl-driver"],"how_to_check":null,"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing mshv_vtl_fault() (the sources do not name a version)","status":"open","published_at":"2026-10-28T11:17:37+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","triaged_at":"2026-10-28T11:35:38+00:00","updated_at":"2026-10-28T11:35:38+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-28T11:35:38Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing mshv_vtl_fault() (the sources do not name a version)","reach":"local","title":"Linux kernel: mshv_vtl mmap path can dereference a NULL register page","impact":"medium","summary":"In the Linux kernel's mshv_vtl driver, a CPU whose register page failed to set up can still be reached through a memory fault, leading to a NULL pointer passed to get_page(). The fix checks the per-CPU register page before taking its reference and returns a bus error when it is missing.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","hyper-v","mshv-vtl"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; the sources only describe a NULL dereference during userspace fault handling","analyst_note":"Check the NVD entry and the upstream kernel commit for the affected and fixed kernel versions, and whether the impact is a crash or code execution.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-mshv-vtl-driver"],"who_is_affected":"Only systems running the Linux kernel with the mshv_vtl driver, which is used for Microsoft Hyper-V VTL (virtual trust level) guests. The sources do not state whether ordinary Linux hosts or guests load this driver, so unknown for general systems. Mixed register-page setup across online CPUs is required to hit the flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000625,"input_tokens":3496,"output_tokens":551,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99168':15A,18A 'absent':216C 'across':172C 'alloc':115C 'anoth':143C 'bus':79B 'check':65B,97C,156C,176C,196C 'configur':121C 'context':135C 'continu':137C 'cpu':38B,69B,100C,113C,128C,144C,164C,181C,201C 'cpus':174C 'cve':13A,16A 'derefer':8A 'driver':36B 'error':80B 'even':178C 'fail':42B,118C 'fault':53B,155C,192C,211C 'fix':64B 'flag':152C,159C 'follow':90C 'get':61B,187C 'global':147C,158C 'hyper':20B 'hyper-v':19B 'initi':134C 'kernel':2A,24B,32B,88C 'lead':54B 'leav':126C 'linux':1A,23B,31B,87C 'linux-kernel':22B 'map':195C 'meanwhil':139C 'memori':52B 'miss':84B 'mix':169C 'mmap':5A,104C 'mshv':3A,26B,34B,95C,119C,148C,153C 'mshv-vtl':25B 'null':10A,57B,132C,189C 'onlin':173C 'option':110C 'page':12A,41B,62B,71B,102C,107C,123C,131C,151C,167C,185C,188C,203C 'pass':59B,177C 'path':6A 'per':68B,99C,200C 'per-cpu':67B,98C,199C 'pointer':58B 'reach':49B,186C 'refer':75B,207C 'reg':122C,130C,150C 'regist':11A,40B,70B,101C,106C,166C,184C,202C 'register-pag':105C 'registr':117C 'request':163C 'resolv':94C 'result':171C 'return':77B,209C 'runtim':28B 'select':161C,198C 'set':44B,145C 'setup':108C,136C,141C,170C 'sigbus':212C 'still':47B 'success':138C,140C 'take':73B,205C 'userspac':191C 'v':21B 'vm':210C 'vtl':4A,27B,35B,96C,120C,154C 'vulner':91C 'warn':124C 'whose':39B","nicknames":[],"mitigations":[],"who_affected":"Only systems running the Linux kernel with the mshv_vtl driver, which is used for Microsoft Hyper-V VTL (virtual trust level) guests. The sources do not state whether ordinary Linux hosts or guests load this driver, so unknown for general systems. Mixed register-page setup across online CPUs is required to hit the flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99168","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99168","severity":null,"published_at":"2026-10-28T11:17:37+00:00","modified_at":"2026-10-28T11:17:37+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","fetched_at":"2026-10-28T11:32:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}