CVE-2026-68166
Description
In the Linux kernel, the following vulnerability has been resolved: userfaultfd: prevent registration of special VMAs Vova Tokarev says: userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can register on the shadow stack, discard a page ... and inject a page with chosen return addresses via UFFDIO_COPY. Update vma_can_userfault() to reject VM_SHADOW_STACK. While on it, also reject VM_SPECIAL so that if a driver would implement vm_uffd_ops, it wouldn't be possible to register special VMAs with userfaultfd. Since VM_SPECIAL includes VM_DONTEXPAND which is set but hugetlb, exclude hugetlb VMAs from the check for VM_SPECIAL.
How to fix
- Linux Linuxd974b4b786214883bd8e56bda10b454c80fd6205, 495a28d5a100be1b232633f4c2dcc42ba10b3796, 165613191ad9d034bf17c00e3a142f9561597ec5, 0c26202b157f1efc3cd2f26f5c30f59b508a6a5d, 3c58f641e813c3c71039f8fd4d4e2a3aab713288 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 54007f818206dc27309ca423df4c87dd160a7208 ≤ v < d974b4b786214883bd8e56bda10b454c80fd6205, 54007f818206dc27309ca423df4c87dd160a7208 ≤ v < 495a28d5a100be1b232633f4c2dcc42ba10b3796, 54007f818206dc27309ca423df4c87dd160a7208 ≤ v < 165613191ad9d034bf17c00e3a142f9561597ec5, 54007f818206dc27309ca423df4c87dd160a7208 ≤ v < 0c26202b157f1efc3cd2f26f5c30f59b508a6a5d, 54007f818206dc27309ca423df4c87dd160a7208 ≤ v < 3c58f641e813c3c71039f8fd4d4e2a3aab713288, 6.6 | d974b4b786214883bd8e56bda10b454c80fd6205, 495a28d5a100be1b232633f4c2dcc42ba10b3796, 165613191ad9d034bf17c00e3a142f9561597ec5, 0c26202b157f1efc3cd2f26f5c30f59b508a6a5d, 3c58f641e813c3c71039f8fd4d4e2a3aab713288 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.