In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level When recovering hugepages in the shadow MMU, verify that the base gfn of the shadow page is actually contained within the target memslot, *before* querying the max mapping level given the shadow page's gfn. Failure to pre-check the validity of the gfn can lead to an out-of-bounds access to the slot's lpage_info (which typically manifests as a host #PF because the lpage_info is vmalloc'd) if the guest creates a hugepage mapping (in its PTEs) that extends "below" the bounds of a memslot. When faulting in memory for a guest, and the size of the guest mapping is greater than KVM's (current) max mapping, then KVM will create a "direct" shadow page (direct in that there are no gPTEs to shadow, and so the target gfn is a direct calculation given the base gfn of the shadow page). The hugepage recovery flow looks for such direct shadow pages, as
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-63807 is a memory safety vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) hypervisor, specifically in the shadow Memory Management Unit (MMU) implementation. The flaw occurs when the kernel attempts to recover hugepages without first validating that a shadow page's base Guest Frame Number (gfn) falls within the target memory slot's boundaries. This validation gap allows out-of-bounds access to the slot's lpage_info structure, typically resulting in a host crash (segmentation fault). The vulnerability affects any system running a vulnerable Linux kernel version with KVM enabled, particularly impacting virtualization environments and cloud infrastructure providers who rely on KVM for hypervisor functionality. With a CVSS score of 8.8, this represents a high-severity issue that can lead to Denial of Service against the host system.
While CVE-2026-63807 lacks explicit MITRE ATT&CK mapping and currently shows zero matching Casky skills, practitioners using Casky.ai's extended reasoning capabilities with Claude would benefit from monitoring for vulnerability patterns related to memory management boundary violations and resource exhaustion attacks. A security practitioner analyzing this vulnerability through Casky's threat modeling would identify attack patterns consistent with techniques like T1499 (Service Exhaustion Denial of Service) and T1561 (Disk Wipe), as successful exploitation could crash hypervisor instances. Organizations should focus detection efforts on kernel panic logs, unusual memory access patterns in KVM processes, and guest-to-host escape attempts. The fix—implementing pre-validation of gfn containment before querying max mapping levels—represents a critical control that practitioners should verify is deployed across their virtualization infrastructure.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-63807. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation