CVE-2026-68166 PUBLISHED

userfaultfd: prevent registration of special VMAs

Assigner: Linux
Reserved: 30.07.2026 Published: 10.08.2026 Updated: 10.08.2026

In the Linux kernel, the following vulnerability has been resolved:

userfaultfd: prevent registration of special VMAs

Vova Tokarev says:

userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can register on the shadow stack, discard a page ... and inject a page with chosen return addresses via UFFDIO_COPY.

Update vma_can_userfault() to reject VM_SHADOW_STACK.

While on it, also reject VM_SPECIAL so that if a driver would implement vm_uffd_ops, it wouldn't be possible to register special VMAs with userfaultfd.

Since VM_SPECIAL includes VM_DONTEXPAND which is set but hugetlb, exclude hugetlb VMAs from the check for VM_SPECIAL.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 54007f818206dc27309ca423df4c87dd160a7208 to 165613191ad9d034bf17c00e3a142f9561597ec5 (excl.)
  • affected from 54007f818206dc27309ca423df4c87dd160a7208 to 0c26202b157f1efc3cd2f26f5c30f59b508a6a5d (excl.)
  • affected from 54007f818206dc27309ca423df4c87dd160a7208 to 3c58f641e813c3c71039f8fd4d4e2a3aab713288 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.6 is affected
  • unaffected from 0 to 6.6 (excl.)
  • unaffected from 6.18.44 to 6.18.* (incl.)
  • unaffected from 7.1.6 to 7.1.* (incl.)
  • unaffected from 7.2-rc5 to * (incl.)

References