CVE-2026-98863

Received Received - Intake

KVM: x86 Nested State Page Handling Failure

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails Re-pend GET_NESTED_STATE_PAGES before exiting to userspace if getting the nested pages fails in the KVM_RUN path. If userspace re-runs the vCPU, and vmcs02 holds valid PFNs from the *previous* run of L2, then KVM could re-enter L2 with stale, unpinned PFNs mapped into e.g. the vAPIC page. Note, both SVM and VMX (as of commit 11722439fb20 ("KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit") ensure the request is cleared on VM-Exit (including the "forced" case), i.e. there is no risk of double-mapping due to emulated VMLAUNCH/VMRESUME/VMRUN *and* the request trying to map the nested pages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98863

EUVD

EUVD-2026-103803

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	671ddc700fd08b94967b1e2a937020e30c838609
Linux	Linux	671ddc700fd08b94967b1e2a937020e30c838609
Linux	Linux	671ddc700fd08b94967b1e2a937020e30c838609
Linux	Linux	5.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel related to KVM (Kernel-based Virtual Machine) on x86 systems. It involves a failure to properly handle nested virtualization state pages during KVM_RUN operations. If getting these nested pages fails, the system may re-pend the GET_NESTED_STATE_PAGES request before exiting to userspace. This could lead to stale, unpinned page frame numbers (PFNs) being reused in subsequent runs, potentially causing incorrect memory mappings in components like the vAPIC page.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem and requires kernel-level inspection. Detection involves checking kernel logs for KVM-related errors or examining kernel version and configuration. Use commands like 'uname -a' to check kernel version and 'dmesg | grep -i kvm' to look for KVM-related errors. If the kernel is vulnerable, update it to a patched version.

Impact Analysis

This vulnerability could allow a malicious guest VM to manipulate memory mappings in the host or other VMs, leading to potential crashes, data corruption, or unauthorized access. Attackers could exploit this to escalate privileges, escape isolation between VMs, or compromise the host system.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a specific technical issue in the Linux kernel's KVM module. Compliance impacts would depend on system configuration and usage rather than this vulnerability itself.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves CVE-2026-98863. Monitor vendor advisories for kernel updates and apply them promptly.

Hi! I’m here to help you understand CVE-2026-98863. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70