chuzhongyun/cve-2026-53359-kernel-fixLinux 内核升级指南 - 修复 CVE-2026-53359
声明： 本文仅记录本人服务器环境下的修复过程，并非安全专业分析。如有不当之处，欢迎指正。
验证说明： 经源码比对确认，Linux Kernel 7.1.3 已包含修复 commit
81ccda30b4e8（"KVM: x86: Fix shadow paging use-after-free due to unexpected role"），该补丁在arch/x86/kvm/mmu/mmu.c的kvm_mmu_get_child_sp()函数中增加了role.word匹配条件，从根本上消除了因 role 不匹配导致的 shadow paging UAF。因此，升级至 7.1.3 可以有效修复此漏洞。
本文档提供两种方式将 Linux Kernel 升级至 7.1.3，用于修复 CVE-2026-53359：ELRepo RPM 安装（推荐）和源码编译。
| 项目 | 说明 |
|---|
| CVE 编号 | CVE-2026-53359 |
| 漏洞组件 | Linux Kernel KVM x86 Shadow MMU |
| 漏洞类型 | Use After Free (UAF) |
| 修复方式 | 升级 Linux Kernel 至 7.1.3（ELRepo RPM 或源码编译） |
漏洞影响：
KVM x86 Shadow Paging 场景中，异常情况下可能出现释放后的页面仍被 rmap 条目引用，引发内存安全问题。
漏洞参考：
| 项目 | 信息 |
|---|---|
| 系统 | CentOS Stream 8 |
| 升级前内核 | 6.18.8-1.el8.elrepo.x86_64 |
| 升级后内核 | 7.1.3 |
| 架构 | x86_64 |
| 虚拟化 | KVM Intel |
查看当前环境：
cat /etc/os-release
uname -r
本教程提供两种升级方式，可根据环境选择：
适用于能正常访问 ELRepo 仓库的环境，无需编译，操作简单。
# 导入 ELRepo GPG 密钥
rpm --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org
# 安装 ELRepo 仓库
dnf install https://www.elrepo.org/elrepo-release-8.el8.elrepo.noarch.rpm
# 安装最新主线内核
dnf --enablerepo=elrepo-kernel install kernel-ml
# 设置新内核为默认启动项
grubby --set-default /boot/vmlinuz-7.1.3-1.el8.elrepo.x86_64
# 重启生效
reboot
注意： 内核版本号可能因 ELRepo 更新而变化，请以实际安装的版本为准。安装后可用
ls /boot/vmlinuz-*查看。
适用于无法访问 ELRepo 仓库，或需要使用 kernel.org 官方 stable 版本的环境。具体步骤见下方。
由于本人服务器环境中：
因此采用：
kernel.org 官方 stable 源码编译方式升级内核。
说明：
该方案仅为本人服务器环境下的解决方法，不代表所有环境必须使用源码编译。
官方下载：
https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.3.tar.xz
下载命令：
wget https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.3.tar.xz
上传位置（离线环境）：
/root/linux-7.1.3.tar.xz
dnf groupinstall "Development Tools" -y
dnf install -y \
ncurses-devel \
elfutils-libelf-devel \
openssl-devel \
bc \
bison \
flex \
perl \
dwarves
mkdir -p /usr/src
cd /usr/src
tar -xf /root/linux-7.1.3.tar.xz
cd linux-7.1.3
ls Makefile # 应显示: Makefile
# 复制当前配置
cp /boot/config-$(uname -r) .config
# 生成新配置
make olddefconfig
# 检查 KVM 配置
grep -E "CONFIG_KVM|CONFIG_KVM_INTEL" .config
预期输出：
CONFIG_KVM=m
CONFIG_KVM_X86=m
CONFIG_KVM_INTEL=m
# 查看 CPU 线程数
nproc
# 编译（使用所有核心）
make -j$(nproc)
# 验证内核镜像
ls -lh arch/x86/boot/bzImage
注意： 编译时间取决于 CPU 和存储性能。
# 安装模块
make modules_install
# 验证安装
ls /lib/modules/
# 检查 KVM 模块
find /lib/modules/7.1.3 -name "kvm*.ko*"
预期输出：
kvm.ko
kvm-intel.ko
kvm-amd.ko
# 安装内核
make install
# 验证安装
ls -lh /boot | grep 7.1.3
预期输出：
vmlinuz-7.1.3
initramfs-7.1.3.img
System.map-7.1.3
# 生成 GRUB 配置
grub2-mkconfig -o /boot/grub2/grub.cfg
# 设置默认内核
grubby --set-default /boot/vmlinuz-7.1.3
# 验证默认内核
grubby --default-kernel
预期输出：
/boot/vmlinuz-7.1.3
reboot
查看内核版本：
uname -r
# 预期: 7.1.3
查看 KVM 模块：
lsmod | grep kvm
# 预期: kvm_intel, kvm, irqbypass
验证 KVM 模块位置：
modinfo kvm_intel | grep filename
# 预期: /lib/modules/7.1.3/kernel/arch/x86/kvm/kvm-intel.ko
重要： 旧内核不应立即删除。
列出可用内核：
grubby --info=ALL | grep kernel
如果新内核有问题，设置旧内核：
grubby --set-default /boot/vmlinuz-6.18.8-1.el8.elrepo.x86_64
reboot
| 项目 | 升级前 | 升级后 |
|---|---|---|
| 内核版本 | 6.18.8-1.el8.elrepo.x86_64 | 7.1.3 |
| KVM 状态 | N/A | 已启用 |
| CVE-2026-53359 | 受影响 | 已修复 |
Disclaimer: This repository only documents my personal fix process on a specific server environment. It is not a professional security analysis. Corrections are welcome.
Verification Note: Source code comparison confirms that Linux Kernel 7.1.3 includes the fix commit
81ccda30b4e8("KVM: x86: Fix shadow paging use-after-free due to unexpected role"). The patch adds arole.wordmatching condition in thekvm_mmu_get_child_sp()function inarch/x86/kvm/mmu/mmu.c, eliminating the shadow paging UAF caused by role mismatch. Therefore, upgrading to 7.1.3 effectively remediates this vulnerability.
This guide provides two methods to upgrade Linux Kernel to 7.1.3 for fixing CVE-2026-53359: ELRepo RPM installation (recommended) and building from source.
| Item | Description |
|---|---|
| CVE ID | CVE-2026-53359 |
| Affected Component | Linux Kernel KVM x86 Shadow MMU |
| Vulnerability Type | Use After Free (UAF) |
| Fix Method | Upgrade Linux Kernel to 7.1.3 (ELRepo RPM or build from source) |
The vulnerability is related to KVM x86 shadow paging. Under specific conditions, freed pages may still be referenced by rmap entries, causing a potential memory safety issue.
References:
| Item | Value |
|---|---|
| OS | CentOS Stream 8 |
| Old Kernel | 6.18.8-1.el8.elrepo.x86_64 |
| New Kernel | 7.1.3 |
| Architecture | x86_64 |
| Virtualization | KVM Intel |
| Compiler | GCC 8.5 |
Check current environment:
cat /etc/os-release
uname -r
This guide provides two upgrade methods. Choose based on your environment:
For environments with reliable access to the ELRepo repository. No compilation required.
# Import ELRepo GPG key
rpm --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org
# Install ELRepo repository
dnf install https://www.elrepo.org/elrepo-release-8.el8.elrepo.noarch.rpm
# Install latest mainline kernel
dnf --enablerepo=elrepo-kernel install kernel-ml
# Set new kernel as default boot entry
grubby --set-default /boot/vmlinuz-7.1.3-1.el8.elrepo.x86_64
# Reboot to apply
reboot
Note: Kernel version numbers may change with ELRepo updates. Check actual installed version with
ls /boot/vmlinuz-*.
For environments without ELRepo access, or when the official kernel.org stable release is required. See detailed steps below.
In my environment:
Therefore:
I used the official kernel.org stable source code and built Kernel 7.1.3 manually.
Note:
This is my own environment solution, not a mandatory upgrade method for all systems.
Official source:
https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.3.tar.xz
Download:
wget https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.3.tar.xz
Upload location (if offline):
/root/linux-7.1.3.tar.xz
dnf groupinstall "Development Tools" -y
dnf install -y \
ncurses-devel \
elfutils-libelf-devel \
openssl-devel \
bc \
bison \
flex \
perl \
dwarves \
tar \
xz
Verify compiler:
gcc --version
mkdir -p /usr/src
cd /usr/src
tar -xf /root/linux-7.1.3.tar.xz
cd linux-7.1.3
ls Makefile # Should show: Makefile
# Copy current kernel configuration
cp /boot/config-$(uname -r) .config
# Generate new configuration
make olddefconfig
# Verify KVM configuration
grep -E "CONFIG_KVM|CONFIG_KVM_INTEL" .config
Expected output:
CONFIG_KVM=m
CONFIG_KVM_X86=m
CONFIG_KVM_INTEL=m
# Check CPU threads
nproc
# Compile (use all available cores)
make -j$(nproc)
# Verify kernel image
ls -lh arch/x86/boot/bzImage
Note: Compilation time depends on CPU and storage performance.
# Install modules
make modules_install
# Verify installation
ls /lib/modules/
# Check KVM modules
find /lib/modules/7.1.3 -name "kvm*.ko*"
Expected output:
kvm.ko
kvm-intel.ko
kvm-amd.ko
# Install kernel
make install
# Verify installation
ls -lh /boot | grep 7.1.3
Expected output:
vmlinuz-7.1.3
initramfs-7.1.3.img
System.map-7.1.3
# Generate GRUB configuration
grub2-mkconfig -o /boot/grub2/grub.cfg
# Set default kernel
grubby --set-default /boot/vmlinuz-7.1.3
# Verify default kernel
grubby --default-kernel
Expected output:
/boot/vmlinuz-7.1.3
reboot
Check kernel version:
uname -r
# Expected: 7.1.3
Check KVM modules:
lsmod | grep kvm
# Expected: kvm_intel, kvm, irqbypass
Verify KVM module location:
modinfo kvm_intel | grep filename
# Expected: /lib/modules/7.1.3/kernel/arch/x86/kvm/kvm-intel.ko
Important: Old kernels should not be removed immediately.
List available kernels:
grubby --info=ALL | grep kernel
If the new kernel has issues, set old kernel:
grubby --set-default /boot/vmlinuz-6.18.8-1.el8.elrepo.x86_64
reboot
| Item | Before | After |
|---|---|---|
| Kernel Version | 6.18.8-1.el8.elrepo.x86_64 | 7.1.3 |
| KVM Status | N/A | Enabled |
| CVE-2026-53359 | Vulnerable | Remediated |