--- id: CVE-2026-68166 title: |- In the Linux kernel, the following vulnerability has been resolved: userfaultfd: prevent registration of special VMAs Vova Tokarev says: userfaultfd allows registration on shadow stack VMAs summary: |- In the Linux kernel, the following vulnerability has been resolved: userfaultfd: prevent registration of special VMAs Vova Tokarev says: userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can regis… severity: high published: '2026-08-10' updated: '2026-08-23' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-68166' references: - url: 'https://git.kernel.org/stable/c/0c26202b157f1efc3cd2f26f5c30f59b508a6a5d' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/165613191ad9d034bf17c00e3a142f9561597ec5' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/3c58f641e813c3c71039f8fd4d4e2a3aab713288' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/495a28d5a100be1b232633f4c2dcc42ba10b3796' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/d974b4b786214883bd8e56bda10b454c80fd6205' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68166.json - url: 'https://access.redhat.com/security/cve/CVE-2026-68166' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2513167' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-68166' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-68166' - url: 'https://access.redhat.com/errata/RHSA-2026:61887' - url: 'https://access.redhat.com/errata/RHSA-2026:67720' - url: 'https://access.redhat.com/errata/RHSA-2026:63129' - url: 'https://access.redhat.com/errata/RHSA-2026:69089' tags: - nvd - csaf - vex - red-hat epss: 0.00209 epssPercentile: 0.09774 ingestedAt: '2026-08-23T13:48:06.487Z' vendor: Red Hat product: Red Hat Enterprise Linux BaseOS (v. 10) affected: - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_eus_v_9_6 - enterprise_linux_appstream_v_9 - enterprise_linux_baseos_v_10 - enterprise_linux_baseos_eus_v_9_6 - enterprise_linux_baseos_v_9 - enterprise_linux_codeready_linux_builder_v_10 - codeready_linux_builder_eus_v_9_6 - enterprise_linux_codeready_linux_builder_v_9 - enterprise_linux_real_time_for_nfv_v_10 - enterprise_linux_real_time_for_nfv_eus_v_9_6 - enterprise_linux_real_time_for_nfv_v_9 - enterprise_linux_real_time_v_10 - enterprise_linux_real_time_eus_v_9_6 - enterprise_linux_real_time_v_9 patched: - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_eus_v_9_6 - enterprise_linux_appstream_v_9 - enterprise_linux_baseos_v_10 - enterprise_linux_baseos_eus_v_9_6 - enterprise_linux_baseos_v_9 - enterprise_linux_codeready_linux_builder_v_10 - codeready_linux_builder_eus_v_9_6 - enterprise_linux_codeready_linux_builder_v_9 - enterprise_linux_real_time_for_nfv_v_10 - enterprise_linux_real_time_for_nfv_eus_v_9_6 - enterprise_linux_real_time_for_nfv_v_9 - enterprise_linux_real_time_v_10 - enterprise_linux_real_time_eus_v_9_6 - enterprise_linux_real_time_v_9 cvss: 7.3 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H' cvssSource: vendor cwe: - CWE-94 --- ## Overview In the Linux kernel, the following vulnerability has been resolved: userfaultfd: prevent registration of special VMAs Vova Tokarev says: userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can register on the shadow stack, discard a page ... and inject a page with chosen return addresses via UFFDIO_COPY. Update vma_can_userfault() to reject VM_SHADOW_STACK. While on it, also reject VM_SPECIAL so that if a driver would implement vm_uffd_ops, it wouldn't be possible to register special VMAs with userfaultfd. Since VM_SPECIAL includes VM_DONTEXPAND which is set but hugetlb, exclude hugetlb VMAs from the check for VM_SPECIAL. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:61887** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:61887) - **RHSA-2026:67720** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6) · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:67720) - **RHSA-2026:63129** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:63129) - **RHSA-2026:69089** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0) · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69089)