---
id: CVE-2026-99168
title: 'mshv_vtl: Check per-CPU register page before mmap'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mshv_vtl: Check per-CPU register page before mmap

  Register-page setup is optional for each CPU. If allocation or
  registration fails, mshv_vtl_configure_reg_page() warn…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7bfe3b8ea6e30437e01fcb8e4f56ef6e4d986d0f <
    5c0757b065fbd140d8fbd05dc2c2146b713dfa68
  - >-
    Linux >= 7bfe3b8ea6e30437e01fcb8e4f56ef6e4d986d0f <
    874194a8de75fc2f4d1fb70c670b289b7e48f93e
  - Linux 6.19
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T10:35:19.539Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99168'
references:
  - url: 'https://git.kernel.org/stable/c/5c0757b065fbd140d8fbd05dc2c2146b713dfa68'
  - url: 'https://git.kernel.org/stable/c/874194a8de75fc2f4d1fb70c670b289b7e48f93e'
tags:
  - cve.org
ingestedAt: '2026-10-28T11:09:40.390Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mshv_vtl: Check per-CPU register page before mmap

Register-page setup is optional for each CPU. If allocation or
registration fails, mshv_vtl_configure_reg_page() warns and leaves that
CPU's reg_page NULL, but initial context setup continues successfully.
Meanwhile, successful setup on another CPU sets the global
mshv_has_reg_page flag.

mshv_vtl_fault() checks this global flag before selecting the requested
CPU's register page. With mixed setup results across online CPUs, the
check passes even for a CPU with no register page, reaching
get_page(NULL) when userspace faults in that mapping.

Check the selected per-CPU register page before taking its reference and
return VM_FAULT_SIGBUS if it is absent.

## Affected

- `Linux >= 7bfe3b8ea6e30437e01fcb8e4f56ef6e4d986d0f < 5c0757b065fbd140d8fbd05dc2c2146b713dfa68`
- `Linux >= 7bfe3b8ea6e30437e01fcb8e4f56ef6e4d986d0f < 874194a8de75fc2f4d1fb70c670b289b7e48f93e`
- `Linux 6.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.