|
ELS
< Back

CVE-2026-68166

Updated on 10 Aug 2026

Severity

Awaiting Analysis

Details

Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

userfaultfd: prevent registration of special VMAs

Vova Tokarev says:

userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can register on the shadow stack, discard a page … and inject a page with chosen return addresses via UFFDIO_COPY.

Update vma_can_userfault() to reject VM_SHADOW_STACK.

While on it, also reject VM_SPECIAL so that if a driver would implement vm_uffd_ops, it wouldn’t be possible to register special VMAs with userfaultfd.

Since VM_SPECIAL includes VM_DONTEXPAND which is set but hugetlb, exclude hugetlb VMAs from the check for VM_SPECIAL.

Details

Affected product:
AlmaLinux 9.2 ESU , Debian 10 ELS , TuxCare 9.6 ESU , TuxCare 9.8 ESU
Affected packages:
kernel @ 5.14.0 (+3 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
AlmaLinux 9 Released
78 kernels
  • 5.14.0-570.12.1.el9_6
  • 5.14.0-570.16.1.el9_6
  • 5.14.0-570.17.1.el9_6
  • 5.14.0-570.18.1.el9_6
  • 5.14.0-570.19.1.el9_6
  • 5.14.0-570.21.1.el9_6
  • 5.14.0-570.22.1.el9_6
  • 5.14.0-570.23.1.el9_6
  • 5.14.0-570.24.1.el9_6
  • 5.14.0-570.25.1.el9_6
  • 5.14.0-570.26.1.el9_6
  • 5.14.0-570.28.1.el9_6
  • 5.14.0-570.30.1.el9_6
  • 5.14.0-570.32.1.el9_6
  • 5.14.0-570.33.2.el9_6
  • 5.14.0-570.35.1.el9_6
  • 5.14.0-570.37.1.el9_6
  • 5.14.0-570.39.1.el9_6
  • 5.14.0-570.41.1.el9_6
  • 5.14.0-570.42.2.el9_6
  • 5.14.0-570.44.1.el9_6
  • 5.14.0-570.46.1.el9_6
  • 5.14.0-570.49.1.el9_6
  • 5.14.0-570.51.1.el9_6
  • 5.14.0-570.52.1.el9_6
  • 5.14.0-570.55.1.el9_6
  • 5.14.0-570.58.1.el9_6
  • 5.14.0-570.60.1.el9_6
  • 5.14.0-570.62.1.el9_6
  • 5.14.0-611.5.1.el9_7
  • 5.14.0-611.9.1.el9_7
  • 5.14.0-611.11.1.el9_7
  • 5.14.0-611.13.1.el9_7
  • 5.14.0-611.16.1.el9_7
  • 5.14.0-611.20.1.el9_7
  • 5.14.0-611.24.1.el9_7
  • 5.14.0-611.26.1.el9_7
  • 5.14.0-611.27.1.el9_7
  • 5.14.0-611.30.1.el9_7
  • 5.14.0-611.34.1.el9_7
  • 5.14.0-611.35.1.el9_7
  • 5.14.0-611.36.1.el9_7
  • 5.14.0-611.38.1.el9_7
  • 5.14.0-611.41.1.el9_7
  • 5.14.0-611.45.1.el9_7
  • 5.14.0-611.42.1.el9_7
  • 5.14.0-611.47.1.el9_7
  • 5.14.0-611.49.1.el9_7
  • 5.14.0-611.54.1.el9_7
  • 5.14.0-611.49.2.el9_7
  • 5.14.0-611.54.3.el9_7
  • 5.14.0-611.54.6.el9_7
  • 5.14.0-687.5.1.el9_8
  • 5.14.0-687.5.3.el9_8
  • 5.14.0-611.55.1.el9_7
  • 5.14.0-687.10.1.el9_8
  • 5.14.0-687.12.1.el9_8
  • 5.14.0-687.13.1.el9_8
  • 5.14.0-687.15.1.el9_8
  • 5.14.0-687.5.4.el9_8
  • 5.14.0-687.17.1.el9_8
  • 5.14.0-687.19.1.el9_8
  • 5.14.0-687.20.1.el9_8
  • 5.14.0-687.22.1.el9_8
  • 5.14.0-687.23.1.el9_8
  • 5.14.0-687.24.1.el9_8
  • 5.14.0-687.25.1.el9_8
  • 5.14.0-687.26.1.el9_8
  • 5.14.0-687.29.1.el9_8
  • 5.14.0-687.30.1.el9_8
  • 5.14.0-687.31.1.el9_8
  • 5.14.0-687.33.1.el9_8
  • 5.14.0-687.34.1.el9_8
  • 5.14.0-687.36.1.el9_8
  • 5.14.0-687.38.1.el9_8
  • 5.14.0-687.39.1.el9_8
  • 5.14.0-687.41.1.el9_8
  • 5.14.0-687.42.1.el9_8
Debian 13 Released
15 kernels
  • 6.12.85-1
  • 6.12.86-1
  • 6.12.88-1
  • 6.12.74-2
  • 6.12.73-1
  • 6.12.63-1
  • 6.12.69-1
  • 6.12.74-1
  • 6.12.90-1
  • 6.12.90-2
  • 6.12.94-1
  • 6.12.95-1
  • 6.12.96-1
  • 6.12.100-1
  • 6.12.101-1
Oracle Linux 9 Released
71 kernels
  • 5.14.0-570.12.1.0.1.el9_6
  • 5.14.0-570.16.1.0.1.el9_6
  • 5.14.0-570.17.1.0.1.el9_6
  • 5.14.0-570.18.1.0.1.el9_6
  • 5.14.0-570.19.1.0.1.el9_6
  • 5.14.0-570.21.1.0.1.el9_6
  • 5.14.0-570.22.1.0.1.el9_6
  • 5.14.0-570.23.1.0.1.el9_6
  • 5.14.0-570.24.1.0.1.el9_6
  • 5.14.0-570.25.1.0.1.el9_6
  • 5.14.0-570.26.1.0.1.el9_6
  • 5.14.0-570.28.1.0.1.el9_6
  • 5.14.0-570.30.1.0.1.el9_6
  • 5.14.0-570.32.1.0.1.el9_6
  • 5.14.0-570.33.2.0.1.el9_6
  • 5.14.0-570.35.1.0.1.el9_6
  • 5.14.0-570.37.1.0.1.el9_6
  • 5.14.0-570.39.1.0.1.el9_6
  • 5.14.0-570.41.1.0.1.el9_6
  • 5.14.0-570.42.2.0.1.el9_6
  • 5.14.0-570.44.1.0.1.el9_6
  • 5.14.0-570.46.1.0.1.el9_6
  • 5.14.0-570.49.1.0.1.el9_6
  • 5.14.0-570.51.1.0.1.el9_6
  • 5.14.0-570.52.1.0.1.el9_6
  • 5.14.0-570.55.1.0.1.el9_6
  • 5.14.0-570.58.1.0.1.el9_6
  • 5.14.0-570.60.1.0.1.el9_6
  • 5.14.0-570.62.1.0.1.el9_6
  • 5.14.0-611.5.1.el9_7
  • 5.14.0-611.9.1.el9_7
  • 5.14.0-611.7.1.el9_7
  • 5.14.0-611.8.1.el9_7
  • 5.14.0-611.11.1.el9_7
  • 5.14.0-611.13.1.el9_7
  • 5.14.0-611.16.1.el9_7
  • 5.14.0-611.20.1.el9_7
  • 5.14.0-611.24.1.el9_7
  • 5.14.0-611.26.1.el9_7
  • 5.14.0-611.27.1.el9_7
  • 5.14.0-611.30.1.el9_7
  • 5.14.0-611.34.1.el9_7
  • 5.14.0-611.35.1.el9_7
  • 5.14.0-611.36.1.el9_7
  • 5.14.0-611.38.1.el9_7
  • 5.14.0-611.41.1.el9_7
  • 5.14.0-611.42.1.el9_7
  • 5.14.0-611.45.1.el9_7
  • 5.14.0-611.47.1.el9_7
  • 5.14.0-611.49.1.el9_7
  • 5.14.0-611.54.1.el9_7
  • 5.14.0-611.55.1.el9_7
  • 5.14.0-687.5.3.el9_8
  • 5.14.0-687.17.1.el9_8
  • 5.14.0-687.20.1.el9_8
  • 5.14.0-687.19.1.el9_8
  • 5.14.0-687.22.1.el9_8
  • 5.14.0-687.24.1.el9_8
  • 5.14.0-687.23.1.el9_8
  • 5.14.0-687.25.1.el9_8
  • 5.14.0-687.26.1.el9_8
  • 5.14.0-687.29.1.el9_8
  • 5.14.0-687.30.1.el9_8
  • 5.14.0-687.31.1.el9_8
  • 5.14.0-687.33.1.el9_8
  • 5.14.0-687.34.1.el9_8
  • 5.14.0-687.36.1.el9_8
  • 5.14.0-687.38.1.el9_8
  • 5.14.0-687.39.1.el9_8
  • 5.14.0-687.41.1.el9_8
  • 5.14.0-687.42.1.el9_8
RHEL 10 Planned —
RHEL 9 Released
76 kernels
  • 5.14.0-570.12.1.el9_6
  • 5.14.0-570.16.1.el9_6
  • 5.14.0-570.17.1.el9_6
  • 5.14.0-570.18.1.el9_6
  • 5.14.0-570.19.1.el9_6
  • 5.14.0-570.21.1.el9_6
  • 5.14.0-570.22.1.el9_6
  • 5.14.0-570.23.1.el9_6
  • 5.14.0-570.24.1.el9_6
  • 5.14.0-570.25.1.el9_6
  • 5.14.0-570.26.1.el9_6
  • 5.14.0-570.28.1.el9_6
  • 5.14.0-570.30.1.el9_6
  • 5.14.0-570.32.1.el9_6
  • 5.14.0-570.33.2.el9_6
  • 5.14.0-570.35.1.el9_6
  • 5.14.0-570.37.1.el9_6
  • 5.14.0-570.39.1.el9_6
  • 5.14.0-570.41.1.el9_6
  • 5.14.0-570.42.2.el9_6
  • 5.14.0-570.44.1.el9_6
  • 5.14.0-570.46.1.el9_6
  • 5.14.0-570.49.1.el9_6
  • 5.14.0-570.51.1.el9_6
  • 5.14.0-570.52.1.el9_6
  • 5.14.0-570.55.1.el9_6
  • 5.14.0-570.58.1.el9_6
  • 5.14.0-570.60.1.el9_6
  • 5.14.0-570.62.1.el9_6
  • 5.14.0-611.5.1.el9_7
  • 5.14.0-611.7.1.el9_7
  • 5.14.0-611.8.1.el9_7
  • 5.14.0-611.9.1.el9_7
  • 5.14.0-611.11.1.el9_7
  • 5.14.0-611.13.1.el9_7
  • 5.14.0-611.16.1.el9_7
  • 5.14.0-611.20.1.el9_7
  • 5.14.0-611.24.1.el9_7
  • 5.14.0-611.26.1.el9_7
  • 5.14.0-611.27.1.el9_7
  • 5.14.0-611.30.1.el9_7
  • 5.14.0-611.34.1.el9_7
  • 5.14.0-611.35.1.el9_7
  • 5.14.0-611.36.1.el9_7
  • 5.14.0-611.38.1.el9_7
  • 5.14.0-611.41.1.el9_7
  • 5.14.0-611.42.1.el9_7
  • 5.14.0-611.45.1.el9_7
  • 5.14.0-611.47.1.el9_7
  • 5.14.0-611.49.1.el9_7
  • 5.14.0-611.54.1.el9_7
  • 5.14.0-611.55.1.el9_7
  • 5.14.0-687.5.1.el9_8
  • 5.14.0-687.5.3.el9_8
  • 5.14.0-687.10.1.el9_8
  • 5.14.0-687.12.1.el9_8
  • 5.14.0-687.13.1.el9_8
  • 5.14.0-687.15.1.el9_8
  • 5.14.0-687.17.1.el9_8
  • 5.14.0-687.19.1.el9_8
  • 5.14.0-687.20.1.el9_8
  • 5.14.0-687.22.1.el9_8
  • 5.14.0-687.24.1.el9_8
  • 5.14.0-687.23.1.el9_8
  • 5.14.0-687.25.1.el9_8
  • 5.14.0-687.26.1.el9_8
  • 5.14.0-687.29.1.el9_8
  • 5.14.0-687.30.1.el9_8
  • 5.14.0-687.31.1.el9_8
  • 5.14.0-687.33.1.el9_8
  • 5.14.0-687.34.1.el9_8
  • 5.14.0-687.36.1.el9_8
  • 5.14.0-687.38.1.el9_8
  • 5.14.0-687.39.1.el9_8
  • 5.14.0-687.41.1.el9_8
  • 5.14.0-687.42.1.el9_8
Rocky Linux 9 Released
54 kernels
  • 5.14.0-570.18.1.el9_6
  • 5.14.0-570.19.1.el9_6
  • 5.14.0-570.21.1.el9_6
  • 5.14.0-570.22.1.el9_6
  • 5.14.0-570.23.1.el9_6
  • 5.14.0-570.25.1.el9_6
  • 5.14.0-570.26.1.el9_6
  • 5.14.0-570.28.1.el9_6
  • 5.14.0-570.30.1.el9_6
  • 5.14.0-570.32.1.el9_6
  • 5.14.0-570.33.2.el9_6
  • 5.14.0-570.37.1.el9_6
  • 5.14.0-570.39.1.el9_6
  • 5.14.0-570.42.2.el9_6
  • 5.14.0-570.49.1.el9_6
  • 5.14.0-570.52.1.el9_6
  • 5.14.0-570.55.1.el9_6
  • 5.14.0-570.58.1.el9_6
  • 5.14.0-611.5.1.el9_7
  • 5.14.0-611.9.1.el9_7
  • 5.14.0-611.11.1.el9_7
  • 5.14.0-611.13.1.el9_7
  • 5.14.0-611.16.1.el9_7
  • 5.14.0-611.20.1.el9_7
  • 5.14.0-611.24.1.el9_7
  • 5.14.0-611.27.1.el9_7
  • 5.14.0-611.26.1.el9_7
  • 5.14.0-611.30.1.el9_7
  • 5.14.0-611.34.1.el9_7
  • 5.14.0-611.36.1.el9_7
  • 5.14.0-611.41.1.el9_7
  • 5.14.0-611.45.1.el9_7
  • 5.14.0-611.47.1.el9_7
  • 5.14.0-611.49.1.el9_7
  • 5.14.0-611.54.1.el9_7
  • 5.14.0-611.55.1.el9_7
  • 5.14.0-687.12.1.el9_8
  • 5.14.0-687.15.1.el9_8
  • 5.14.0-687.17.1.el9_8
  • 5.14.0-687.10.1.el9_8.0.1
  • 5.14.0-687.22.1.el9_8
  • 5.14.0-687.24.1.el9_8
  • 5.14.0-687.25.1.el9_8
  • 5.14.0-687.26.1.el9_8
  • 5.14.0-687.29.1.el9_8
  • 5.14.0-687.30.1.el9_8
  • 5.14.0-687.31.1.el9_8
  • 5.14.0-687.33.1.el9_8
  • 5.14.0-687.34.1.el9_8
  • 5.14.0-687.36.1.el9_8
  • 5.14.0-687.38.1.el9_8
  • 5.14.0-687.39.1.el9_8
  • 5.14.0-687.41.1.el9_8
  • 5.14.0-687.42.1.el9_8