CVE-2026-98283

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() kvmhv_emulate_tlbie_all_lpid() iterates the nested-guest IDR and drops mmu_lock before calling kvmhv_emulate_tlbie_lpid(), but does not hold a reference on the kvm_nested_guest pointer obtained from the IDR. A concurrent vCPU issuing a single-LPID tlbie (is=2, ric=2) can race through kvmhv_flush_nested() -> kvmhv_remove_nested() -> idr_remove / --refcnt -> kvmhv_release_nested() -> kfree(gp) in that window, leaving the iterating vCPU with a dangling pointer. The subsequent mutex_lock(&gp->tlb_lock) and accesses to gp->shadow_pgtable, gp->shadow_lpid and gp->l1_host all touch freed memory. The free path is fully L1-controlled. Fix this by incrementing gp->refcnt inside the loop before dropping mmu_lock, mirroring what kvmhv_get_nested() does, and releasing the reference with kvmhv_put_nested() after the per-guest work completes. This is the same get/put discipline already used at every other call site that drops mmu_lock while holding a nested-guest pointer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98283

EUVD

EUVD-2026-93211

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	e3b6b4661527e821ffbe3db83952fdb1e6e47c49
Linux	Linux	e3b6b4661527e821ffbe3db83952fdb1e6e47c49
Linux	Linux	e3b6b4661527e821ffbe3db83952fdb1e6e47c49
Linux	Linux	e3b6b4661527e821ffbe3db83952fdb1e6e47c49
Linux	Linux	e3b6b4661527e821ffbe3db83952fdb1e6e47c49
Linux	Linux	e3b6b4661527e821ffbe3db83952fdb1e6e47c49
Linux	Linux	4.20

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) module for PowerPC (PPC) Book3S HV. It occurs in the function kvmhv_emulate_tlbie_all_lpid() where a dangling pointer is accessed after the referenced memory is freed. The issue arises due to improper reference counting when iterating over nested-guest IDs while holding a pointer without incrementing its reference count.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM implementation for PowerPC (PPC) Book3S HV. Detection requires checking kernel logs for crashes or memory corruption related to KVM operations. Commands like dmesg | grep -i kvm or journalctl -k | grep -i kvm may show errors. Kernel version checks with uname -a can confirm if your system is affected.

Impact Analysis

This vulnerability could allow a local attacker in a guest virtual machine to cause a denial-of-service (DoS) condition or potentially execute arbitrary code in the host kernel. It may lead to system crashes, data corruption, or unauthorized access depending on the kernel's memory state after the use-after-free occurs.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's KVM PPC: Book3S HV module, which could lead to memory corruption and potential arbitrary code execution. While it does not directly impact compliance with GDPR or HIPAA, such vulnerabilities can compromise system integrity, potentially leading to unauthorized data access or breaches. Compliance frameworks often require timely patching of critical vulnerabilities to maintain security controls.

Mitigation Strategies

Apply the kernel patch provided for CVE-2026-98283. Update to a fixed Linux kernel version. If immediate patching is not possible, disable nested virtualization in KVM by setting options like nested=0 in the KVM module parameters. Monitor for crashes or memory corruption as indicators of exploitation.

Hi! I’m here to help you understand CVE-2026-98283. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70