QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2026-23432

Back to search

CVE-2026-23432

Published: Apr 3, 2026

Modified: May 11, 2026

PUBLISHED

CVSS v3.1

7.8

HIGH

Description

In the Linux kernel, the following vulnerability has been resolved: mshv: Fix use-after-free in mshv_map_user_memory error path In the error path of mshv_map_user_memory(), calling vfree() directly on the region leaves the MMU notifier registered. When userspace later unmaps the memory, the notifier fires and accesses the freed region, causing a use-after-free and potential kernel panic. Replace vfree() with mshv_partition_put() to properly unregister the MMU notifier before freeing the region.

VendorProductVersions

Linux

Linux

affected
b9a66cd5ccbb9fade15d0e427e19470d8ad35b75 - < 34861bdc0c0196b6c2dd48f7454029407704ff6e
affected
b9a66cd5ccbb9fade15d0e427e19470d8ad35b75 - < 6922db250422a0dfee34de322f86b7a73d713d33

Linux

Linux

affected
6.19
unaffected
0 - < 6.19
unaffected
6.19.10 - <= 6.19.*
unaffected
7.0 - <= *

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now