CVE-2026-43486: Kernel Contpte Fault in Linux Kernel

The vulnerability lies in the contpteptepsetaccessflags() function, where a comparison against the gathered PTEP value could be misleading. Specifically, ptepget() ORs AF/dirty flags from all sub-PTEs, meaning a dirty sibling PTE could falsely indicate the target is already dirty. This can cause the function to return prematurely, even if the target sub-PTE still has PTERDONLY set in hardware. An attacker could potentially exploit this to bypass access controls and gain unauthorized access to memory regions. While the description mentions FEAT_HAFDBS, the core issue impacts systems regardless of this feature's presence, as the flawed logic remains. The potential impact includes privilege escalation and data breaches.

1. 已保留2026-05-01
2. 发布日期2026-05-13

The primary mitigation for CVE-2026-43486 is to upgrade the Linux Kernel to version 97c5550b763171dbef61e6239cab372b9f9cd4a2 or later. Before upgrading, ensure compatibility with existing hardware and software. If a direct upgrade is not feasible due to compatibility issues, consider rolling back to a previous stable kernel version if possible, although this may introduce other vulnerabilities. There are no specific WAF or proxy rules applicable to this kernel-level vulnerability. Monitor kernel logs for any unusual memory access patterns after the upgrade.