CVE-2026-43096 mshv: Fix infinite fault loop on permission-denied GPA intercepts
A malicious guest can cause an infinite fault loop in the Linux kernel's mshv driver, leading to host resource exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43096?
CVE-2026-43096 is a medium-severity denial of service vulnerability in Linux kernel, published on 6 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mshv: Fix infinite fault loop on permission-denied GPA intercepts
Prevent infinite fault loops when guests access memory regions without proper permissions. Currently, mshv_handle_gpa_intercept() attempts to remap pages for all faults on movable memory regions, regardless of whether the access type is permitted. When a guest writes to a read-only region, the remap succeeds but the region remains read-only, causing immediate re-fault and spinning the vCPU indefinitely.
Validate intercept access type against region permissions before attempting remaps. Reject writes to non-writable regions and executes to non-executable regions early, returning false to let the VMM handle the intercept appropriately.
This also closes a potential DoS vector where malicious guests could intentionally trigger these fault loops to consume host resources.
Weakness: CWE-835
Which versions are affected by CVE-2026-43096?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43096?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-43096 being exploited?
There is no known exploitation of CVE-2026-43096 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2026-43096, GHSA-6g6j-j4qf-ch65, UBUNTU-CVE-2026-43096.