Attack Chain

1. A malicious guest OS attempts to trigger memory allocation and deallocation operations.
2. The Intel EPT paging code initiates a modification of the page table, acquiring the p2m lock.
3. The EPT code schedules a flush of the cached EPT state, but defers the actual flush until the p2m lock is released.
4. Before the flush occurs, the memory page associated with the modified page table entry is freed.
5. The freed page is now available for reuse by other processes or virtual machines.
6. The cached EPT state still contains a stale entry pointing to the now-freed memory page.
7. Another process or VM allocates the previously freed memory page.
8. Due to the stale EPT entry, the malicious guest OS can now access the memory contents of the newly allocated page, leading to information disclosure or potentially code execution.

Impact

Successful exploitation of CVE-2026-23554 could allow a malicious guest operating system to read or write memory belonging to other virtual machines or the hypervisor itself. This could lead to complete compromise of the affected system, including information disclosure, privilege escalation, and denial of service. The vulnerability has a CVSS v3.1 base score of 7.8, indicating a high severity. The potential impact spans across various sectors utilizing virtualization technologies, including cloud service providers, data centers, and enterprise environments.

Recommendation

• Apply the patch or mitigation provided by Intel or your virtualization platform vendor to address CVE-2026-23554 as soon as it becomes available.
• Monitor hypervisor logs for unusual memory access patterns that may indicate exploitation of this vulnerability. Enable appropriate logging within the hypervisor to capture EPT-related events.