CVE-2026-98469

Received Received - Intake

KVM: arm64 DBGBXVR Register Handling Fix

Publication date: 2026-10-18

Last updated on: 2026-10-24

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix AArch32 DBGBXVR<n> handling The consolidation of the breakpoint and watchpoint register accessors switched DBGBXVR<n> from trap_bvr() to trap_dbg_wb_reg(). The latter selects backing storage with demux_wb_reg(), which only handles Op2 values 4 through 7. Since DBGBXVR<n> uses Op2 1, an AArch32 guest access hits KVM_BUG_ON() and marks the VM dead. DBGBXVR<n> aliases DBGBVR<n>_EL1[63:32], and its AA32(HI) descriptor already selects the upper half. Map Op2 1 to dbg_bvr[] alongside Op2 4, restoring the pre-regression behavior.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-24

Generated

2026-11-08

AI Q&A

2026-10-18

EPSS Evaluated

2026-11-07

NVD

CVE-2026-98469

EUVD

EUVD-2026-103709

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	3ce9f3357e9e099f02feaa002769eb99ef1138cd
Linux	Linux	3ce9f3357e9e099f02feaa002769eb99ef1138cd
Linux	Linux	3ce9f3357e9e099f02feaa002769eb99ef1138cd
Linux	Linux	6.14

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel affects KVM for arm64 systems. It involves incorrect handling of AArch32 breakpoint and watchpoint registers (DBGBXVR<n>). The issue causes a guest VM to crash when accessing these registers due to a regression in register accessor consolidation.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM implementation for arm64 systems. Detection requires checking kernel logs for KVM-related errors or crashes involving DBGBXVR<n> register access. Monitor dmesg or system logs for KVM_BUG_ON() triggers or VM deadlock events.

Impact Analysis

If you use KVM on arm64 with AArch32 guests, this vulnerability could cause guest VMs to crash unexpectedly. This may lead to denial of service for virtual machines running on affected systems.

Compliance Impact

This vulnerability is specific to the Linux kernel's KVM implementation for arm64 and involves a bug in handling AArch32 breakpoint and watchpoint registers. It does not directly impact data privacy, security controls, or compliance with standards like GDPR or HIPAA.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the KVM arm64 DBGBXVR<n> handling issue. If immediate patching is not possible, disable KVM virtualization for AArch32 guests as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-98469. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...