CVE-2026-98440 (GCVE-0-2026-98440)
Vulnerability from cvelistv5
Published
2026-10-18 15:14
Modified
2026-10-24 14:08
Severity ?
7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction We free the shadow S2 structures from kvm_arch_flush_shadow_all(), which is a Bad Idea(tm). Freeing the page tables is fair game (this is what this callback is for), but freeing the container that could still be referenced by another part of the system is not great. Instead, grow separate destructors that gets called when we tear the VM down for good. From there, we can nuke both the individual MMUs as well as the global array that points to them, safe in the knowledge that the vcpus themselves have been destroyed already.
References
Impacted products
Vendor Product Version
Linux Linux Version: 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51
Version: 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51
Version: 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51
Version: 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/kvm_nested.h",
            "arch/arm64/kvm/arm.c",
            "arch/arm64/kvm/nested.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "876049f026b4dfaca0cc78ec81be0e639ca8525d",
              "status": "affected",
              "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51",
              "versionType": "git"
            },
            {
              "lessThan": "22e82acec93a681071ed36f70eabe2d0c4e0bebd",
              "status": "affected",
              "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51",
              "versionType": "git"
            },
            {
              "lessThan": "5bf1c9175e657b3c2dc1cf77403031ac7aadcf66",
              "status": "affected",
              "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51",
              "versionType": "git"
            },
            {
              "lessThan": "e5843f4effaa2ffac3e789ecd4456403564961d4",
              "status": "affected",
              "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/kvm_nested.h",
            "arch/arm64/kvm/arm.c",
            "arch/arm64/kvm/nested.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.113",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.56",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.9",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction\n\nWe free the shadow S2 structures from kvm_arch_flush_shadow_all(), which\nis a Bad Idea(tm). Freeing the page tables is fair game (this is what\nthis callback is for), but freeing the container that could still be\nreferenced by another part of the system is not great.\n\nInstead, grow separate destructors that gets called when we tear the VM\ndown for good. From there, we can nuke both the individual MMUs as well\nas the global array that points to them, safe in the knowledge that the\nvcpus themselves have been destroyed already."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Local close() of the last KVM FD reaches kvm_put_kvm() -\u003e kvm_destroy_vm() -\u003e mmu_notifier_unregister() -\u003e kvm_mmu_notifier_release() -\u003e patched kvm_arch_flush_shadow_all(), while concurrent munmap() reaches kvm_unmap_gfn_range() -\u003e kvm_nested_s2_unmap().\nAC:H - Although one process controls both close() and munmap() and stage2_apply_range() drops mmu_lock, reachability requires FEAT_NV2 hardware booted with the explicitly non-default experimental kvm-arm.mode=nested; a low-privileged attacker cannot establish that host state.\nPR:L - The setup uses KVM_CREATE_VM, KVM_CREATE_VCPU, KVM_ARM_VCPU_INIT with KVM_ARM_VCPU_HAS_EL2, and KVM_SET_USER_MEMORY_REGION; none has a capable() check, so an unprivileged local user granted /dev/kvm access suffices.\nUI:N - The attacker creates and runs the nested VM, races munmap() against closing its KVM descriptors, and needs no action from another user.\nS:U - The demonstrated attacker is a host-side /dev/kvm user and the corruption remains in that host kernel; no guest-controlled operation invokes the required close()/munmap() teardown race, so this is local kernel escalation rather than a guest escape.\nC:H - After vulnerable kvm_arch_flush_shadow_all() frees the kvm_s2_mmu block, an in-flight stage2_apply_range() rereads reclaimable mmu-\u003epgt; controlling the replacement kernel object can steer page-table memory accesses and expose arbitrary kernel data.\nI:H - The reclaimed mmu-\u003epgt pointer is passed to kvm_pgtable_stage2_unmap(), whose page-table walker modifies entries through that pointer, giving the kernel-heap use-after-free arbitrary-write and control-flow-hijacking potential.\nA:H - Dereferencing the freed kvm_s2_mmu or a reclaimed mmu-\u003epgt in stage2_apply_range() and kvm_pgtable_stage2_unmap() can produce a host kernel oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T14:08:48.611Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/876049f026b4dfaca0cc78ec81be0e639ca8525d"
        },
        {
          "url": "https://git.kernel.org/stable/c/22e82acec93a681071ed36f70eabe2d0c4e0bebd"
        },
        {
          "url": "https://git.kernel.org/stable/c/5bf1c9175e657b3c2dc1cf77403031ac7aadcf66"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5843f4effaa2ffac3e789ecd4456403564961d4"
        }
      ],
      "title": "KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98440",
    "datePublished": "2026-10-18T15:14:50.740Z",
    "dateReserved": "2026-09-25T10:25:14.349Z",
    "dateUpdated": "2026-10-24T14:08:48.611Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.