cve 2026 68428

CVE-2026-68428 is a Linux KVM/x86 memory-safety fix that matters chiefly to hosts which load, unload, and reload the kvm-intel or other KVM vendor module while the core kvm module remains resident. The practical failure is a host-kernel slab use-after-free during a rare initialization error path—not a flaw in Windows Hyper-V, and not evidence of a guest-to-host escape. But administrators running Linux KVM infrastructure should treat it as a patch-now item because the vulnerable cleanup state can persist across module reloads. The NVD published the CVE record on August 10, 2026, but the underlying upstream fix is older: Phil Rosenthal’s patch entered the Linux tree earlier, so applying the latest kernel update is essential.