CVE-2026-98164
Received Received - Intake

KVM: x86/mmu Write Tracking Bypass in Linux Kernel

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check write tracking in all address spaces kvm_gfn_is_write_tracked() checks only the supplied memslot, but page tracking is per-address-space and shadow pages are shared across all address spaces. With SMM, a GFN can therefore be write-tracked in one address space and appear untracked through the other. Check the supplied slot first, then the slot for the other address space. This ensures all callers honor write tracking regardless of the active address space. In particular, it prevents mmu_try_to_unsync_pages() from marking an upper-level shadow page unsync and eventually triggering the BUG in pte_list_remove(). [invert direction of the conditional. - Paolo]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2026-98164
EUVD
EUVD-2026-88753

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect write tracking in KVM's x86/mmu module. The function kvm_gfn_is_write_tracked() only checks the current memslot for write tracking, but page tracking is managed per address space. Shadow pages are shared across all address spaces, which can lead to inconsistencies. Specifically, a GFN might be write-tracked in one address space but appear untracked in another, causing issues with memory management and potentially triggering a BUG in pte_list_remove().

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM (Kernel-based Virtual Machine) x86/mmu component. Detection requires checking the kernel version and KVM module behavior. Use commands like 'uname -a' to verify kernel version and 'lsmod | grep kvm' to check KVM module status. Monitor kernel logs for related errors or warnings.

Impact Analysis

This vulnerability could lead to memory corruption or crashes in systems using KVM virtualization, particularly those with SMM (System Management Mode). It may cause unexpected behavior in virtual machines, data corruption, or system instability due to improper handling of write-tracked memory pages.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the vulnerability. Restart systems using KVM to ensure the updated kernel is active. If immediate patching is not possible, consider disabling KVM or using alternative virtualization solutions until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98164. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart