CVE-2026-98470

Received Received - Intake

KVM: arm64 Protected Mode VM ioctl Validation Bypass

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode kvm_pkvm_ioctl_allowed() WARNs when kvm_get_cap_for_kvm_ioctl() doesn't find the ioctl number in vm_ioctl_caps[], and kvm_arch_vm_ioctl() calls it for every number the generic code doesn't handle, so ioctl(vm_fd, 0xdeadbeef) from userspace taints a pKVM host and panics it under panic_on_warn. The lookup is fed userspace input: return false, and userspace gets the -EINVAL kvm_arch_vm_ioctl() returns for that number on a host without pKVM.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98470

EUVD

EUVD-2026-103710

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	b12b3b04f6ba072ca5a618a75e546c996be94bd1
Linux	Linux	b12b3b04f6ba072ca5a618a75e546c996be94bd1
Linux	Linux	7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the KVM (Kernel-based Virtual Machine) arm64 implementation. When a userspace program calls an unknown VM ioctl (input/output control) command in protected mode, the kernel triggers a warning that can lead to a host panic if panic_on_warn is enabled. The issue arises because the kernel attempts to validate ioctl numbers using a lookup table fed by userspace input, which can be manipulated to cause a denial of service.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM arm64 protected mode. Detection requires checking kernel logs for WARN messages related to unknown VM ioctls. Use 'dmesg | grep -i warn' or 'journalctl -k | grep -i warn' to search for warnings. If pKVM is enabled, test for the issue by running 'ioctl(vm_fd, 0xdeadbeef)' in a controlled environment and observe if it triggers a kernel panic.

Check if your system uses a vulnerable kernel version with 'uname -r'. Compare against patched versions listed in your distribution's security advisories.

Impact Analysis

If you are running a Linux system with KVM and pKVM (protected KVM) enabled, an attacker with local access could trigger this vulnerability by sending a maliciously crafted ioctl command. This could cause the host system to panic, resulting in a denial of service. Systems without pKVM are not affected.

Compliance Impact

This vulnerability could impact compliance by causing system outages, which may violate availability requirements in standards like GDPR or HIPAA. A denial of service could lead to unauthorized data access or loss, potentially breaching confidentiality or integrity requirements.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch the vulnerability. If immediate patching is not possible, disable pKVM protected mode by removing the 'kvm-arm.mode=protected' kernel parameter if present in your boot configuration.

Restrict access to /dev/kvm to trusted users only using 'chmod 600 /dev/kvm' and ensure proper SELinux or AppArmor policies are enforced. Monitor kernel logs for any signs of exploitation attempts.

Hi! I’m here to help you understand CVE-2026-98470. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70