Riskcovery

CVE-2026-68166

userfaultfd: prevent registration of special VMAs

State
Published
Severity
Not scored
Published
Aug 10, 2026
Updated
Aug 23, 2026
Reserved
Jul 30, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

userfaultfd: prevent registration of special VMAs

Vova Tokarev says:

userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can register on the shadow stack, discard a page ... and inject a page with chosen return addresses via UFFDIO_COPY.

Update vma_can_userfault() to reject VM_SHADOW_STACK.

While on it, also reject VM_SPECIAL so that if a driver would implement vm_uffd_ops, it wouldn't be possible to register special VMAs with userfaultfd.

Since VM_SPECIAL includes VM_DONTEXPAND which is set but hugetlb, exclude hugetlb VMAs from the check for VM_SPECIAL.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 54007f818206dc27309ca423df4c87dd160a7208 to before d974b4b786214883bd8e56bda10b454c80fd6205Affected
  • 54007f818206dc27309ca423df4c87dd160a7208 to before 495a28d5a100be1b232633f4c2dcc42ba10b3796Affected
  • 54007f818206dc27309ca423df4c87dd160a7208 to before 165613191ad9d034bf17c00e3a142f9561597ec5Affected
  • 54007f818206dc27309ca423df4c87dd160a7208 to before 0c26202b157f1efc3cd2f26f5c30f59b508a6a5dAffected
  • 54007f818206dc27309ca423df4c87dd160a7208 to before 3c58f641e813c3c71039f8fd4d4e2a3aab713288Affected
LinuxLinux
  • 6.6Affected
  • before 6.6Not affected
  • 6.6.153 through 6.6.*Not affected
  • 6.12.105 through 6.12.*Not affected
  • 6.18.44 through 6.18.*Not affected
  • 7.1.6 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.