CVE-2026-23432

mshv: Fix use-after-free in mshv_map_user_memory error path

High · published April 3, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
1.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

mshv: Fix use-after-free in mshv_map_user_memory error path

In the error path of mshv_map_user_memory(), calling vfree() directly on

the region leaves the MMU notifier registered. When userspace later unmaps

the memory, the notifier fires and accesses the freed region, causing a

use-after-free and potential kernel panic.

Replace vfree() with mshv_partition_put() to properly unregister

the MMU notifier before freeing the region.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00120 · 1.7th percentile
Published
2026-04-03T15:15Z
EPSS history
Timeline
  • 03 APR 15:15Z
    mshv: Fix use-after-free in mshv_map_user_memory error path
    cvelistv5