Cyber ·
KVM/x86 on Linux: stale SMM MMIO cache lets writes bypass write tracking
Security advisory from the oss-sec feed dated October 19, 2026 describes a KVM/x86 flaw a guest can trigger to modify a memory page without the hypervisor's write tracking.
On October 19, 2026, the oss-sec feed published a machine translation of a report about Linux KVM/x86. According to the report, a write-tracking bypass can be triggered by a guest virtual machine through the per-vCPU MMIO cache. In the main version before the fix, a KVM test reproduces a write to tracked RAM that results in KVM_EXIT_MMIO and a WARN_ON_ONCE() in kvm_mmu_write_protect_fault(). According to the report, a VMM that completes such an exit against RAM can modify the backing page without KVM write tracking. The text notes that KVM uses separate memslot address spaces for normal and SMM use, and that MMIO cache population and validity checks are part of the analysis. The excerpt is truncated, so the full analysis, affected versions and fix should be checked in the original source. To verify, consult the original advisory in the Linux security mailing list archive and the advisories from your distribution.
Original source: Linux KVM/x86: cache MMIO SMM obsoleto contorna o rastreamento de gravações