CVE-2026-98638

Received Received - Intake

KVM: arm64 SVE Vector Length Validation Flaw

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() pkvm_vcpu_init_sve() clamps only the upper bound of the host-provided sve_max_vl, so an invalid vector length reaches sve_state_size_from_vl() and the WARN_ON() there, which is fatal at EL2. The existing !sve_state_size test rejects such a length, but only after the macro has run. Check sve_vl_valid() before deriving the state size. A valid length cannot yield a zero size, so the !sve_state_size test goes with it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98638

EUVD

EUVD-2026-103552

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	5db1bef933427aa467ad89c7b695a84a6b4afe16
Linux	Linux	5db1bef933427aa467ad89c7b695a84a6b4afe16
Linux	Linux	5db1bef933427aa467ad89c7b695a84a6b4afe16
Linux	Linux	6.16

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in KVM for arm64 systems. It involves improper validation of the SVE vector length in the function pkvm_vcpu_init_sve(). The function only checks the upper bound of sve_max_vl, allowing invalid lengths to reach a fatal error at EL2.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM implementation for arm64 systems. Detection requires checking kernel logs for WARN_ON() triggers related to SVE vector length validation failures. Monitor dmesg or system logs for errors from pkvm_vcpu_init_sve() or sve_state_size_from_vl(). No direct network detection commands are applicable.

Impact Analysis

An attacker could exploit this to cause a denial of service or potentially escalate privileges on affected systems by triggering a fatal error in the kernel.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel issue in KVM for arm64 systems. It may indirectly impact compliance if exploited to gain unauthorized access to virtual machines, potentially violating data protection requirements.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the KVM arm64 SVE vector length validation issue.

Hi! I’m here to help you understand CVE-2026-98638. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70