PatchSiren cyber security CVE debrief

CVE-2026-45851 Linux CVE debrief

A vulnerability in the Linux kernel's EFI subsystem could cause kernel panics on Intel TDX virtual machines with large memory configurations. The `reserve_unaccepted()` function miscalculates the memblock reservation size for the unaccepted memory table when the table's starting physical address is not page-aligned. This leaves the end of the table unreserved, potentially causing it to be overwritten and triggering a panic in `accept_memory()`. The issue was observed with memory sizes exceeding 64GB.

Vendor: Linux
Product: Unknown
CVSS: HIGH 7.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-27
Original CVE updated: 2026-06-25
Advisory published: 2026-05-27
Advisory updated: 2026-06-25

Who should care

Organizations running Intel TDX confidential computing workloads with large memory allocations (>64GB), Linux kernel maintainers, virtualization platform operators, and cloud providers offering TDX-based confidential VMs.

Technical summary

The vulnerability exists in `reserve_unaccepted()` in the Linux kernel's EFI subsystem. The function aligns the size of the unaccepted memory table but fails to account for unaligned starting physical addresses. When `efi.unaccepted` is not page-aligned, the aligned size may not cover the full table range, leaving the end unreserved. This causes the table to potentially be overwritten, leading to kernel panics in `accept_memory()` when processing unaccepted memory. The fix calculates the end address first (including unaligned start) then aligns upward to ensure complete coverage.

Defensive priority

medium

Recommended defensive actions

Apply the relevant stable kernel patch for your kernel version
For Intel TDX deployments with >64GB memory, prioritize patching
Verify memblock reservation behavior in EFI boot logs if experiencing kernel panics on TDX VMs
Monitor kernel stable tree for additional backports

Evidence notes

The vulnerability description indicates this was resolved in the Linux kernel stable tree with commits across multiple kernel versions. The issue specifically affects Intel TDX (Trust Domain Extensions) VMs and was observed with memory configurations greater than 64GB.

Sources and references

Verified primary and authoritative sources

CVE-2026-45851 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-45851

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-45851 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45851

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/0862438c90487e79822d5647f854977d50381505

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/9b18bf59977f5c5bc3b11b210520f62500a7adf3

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/b7bc182ec1846be437351e44164089d988f9d0dd

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/ba6b6f1502fa55621d1db23f253d54322bdbe4e0

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/e649b5916725c68f44ebf45fb396df563c5dbaf2

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.