Cloudanix VulnDB

CVE-2026-99168

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel can make some systems using certain virtualization features crash when software tries to access special memory pages.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Null pointer dereference in mshv_vtl_fault when global mshv_has_reg_page flag is set but selected per-CPU reg_page is NULL, resulting in get_page(NULL) during userspace page fault handling.

Why it matters to the business

May cause kernel crashes or instability on systems running affected Linux kernels in virtualized or hypervisor-related workloads, with elevated urgency due to publication only three days ago.

How an attack unfolds

An attacker with local access maps the register page region; after mixed per-CPU setup leaves some CPUs without a reg_page, a fault on such a CPU bypasses the absent check and triggers the null dereference in the kernel fault handler.

How to fix it

Update to a Linux kernel containing the fix that checks the per-CPU register page before reference and returns VM_FAULT_SIGBUS on absence; apply vendor kernel updates as soon as available.

How to confirm the fix worked

Confirm kernel version contains the commit checking per-CPU reg_page in mshv_vtl_fault; review dmesg for warnings from mshv_vtl_configure_reg_page and test fault behavior on mixed-success CPU setups.

Typical attack path

  1. Obtain local unprivileged access to an affected Linux system
  2. Trigger mshv_vtl register page mapping for a CPU that failed allocation
  3. Cause page fault on the mapping to reach get_page(NULL)
  4. Trigger kernel oops or memory corruption

How to detect it

Search kernel logs for mshv_vtl warnings about failed reg_page allocation followed by faults; inspect for oops traces referencing mshv_vtl_fault and get_page.

What your security team should do

  • Prioritize kernel updates for all systems using mshv_vtl
  • Monitor for kernel oops involving mshv_vtl_fault
  • Restrict unprivileged access to hypervisor interfaces until patched

The record

In the Linux kernel, the following vulnerability has been resolved: mshv_vtl: Check per-CPU register page before mmap Register-page setup is optional for each CPU. If allocation or registration fails, mshv_vtl_configure_reg_page() warns and leaves that CPU's reg_page NULL, but initial context setup continues successfully. Meanwhile, successful setup on another CPU sets the global mshv_has_reg_page flag. mshv_vtl_fault() checks this global flag before selecting the requested CPU's register page. With mixed setup results across online CPUs, the check passes even for a CPU with no register page, reaching get_page(NULL) when userspace faults in that mapping. Check the selected per-CPU register page before taking its reference and return VM_FAULT_SIGBUS if it is absent.

Affected packages

Ecosystem Package Introduced Fixed