CVE-2026-98433
Received Received - Intake

Memory Leak in Linux Kernel KVM PPC HV

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure In kvmppc_svm_page_in(), if uv_page_in() fails after kvmppc_uvmem_get_page() has succeeded, the secure device page is never released. kvmppc_uvmem_get_page() sets a bit in kvmppc_uvmem_bitmap, allocates a kvmppc_uvmem_page_pvt struct, marks the GFN as KVMPPC_GFN_UVMEM_PFN, and calls zone_device_page_init() which sets refcount=1 and locks the page. The subsequent goto out_finalize skips the *mig.dst assignment, so migrate_vma_finalize() is a no-op for the page, and none of those resources are ever reclaimed. Each occurrence permanently consumes one entry from the firmware-bounded secure memory pool (kvmppc_uvmem_bitmap), leaks pvt, and leaves the GFN marked as secure — making it unusable for the lifetime of the VM. The twin __kvmppc_svm_page_out() already handles the analogous uv_page_out() failure correctly with unlock_page(dpage); __free_page(dpage). Apply the same pattern here: unlock_page() followed by put_page(), which chains through free_zone_device_folio() into kvmppc_uvmem_folio_free() to clear the bitmap bit, free pvt, and reset the GFN state. Reachable whenever uv_page_in() returns an error (e.g. UV pool exhaustion) on any POWER9/10 + Ultravisor/PEF system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98433
EUVD
EUVD-2026-103671

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux ca9f4942670c37407bb109090eaf776ce2ccc54c
Linux Linux ca9f4942670c37407bb109090eaf776ce2ccc54c
Linux Linux ca9f4942670c37407bb109090eaf776ce2ccc54c
Linux Linux ca9f4942670c37407bb109090eaf776ce2ccc54c
Linux Linux ca9f4942670c37407bb109090eaf776ce2ccc54c
Linux Linux ca9f4942670c37407bb109090eaf776ce2ccc54c
Linux Linux ca9f4942670c37407bb109090eaf776ce2ccc54c
Linux Linux ca9f4942670c37407bb109090eaf776ce2ccc54c
Linux Linux 5.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel affects KVM for PPC Book3S HV systems. When uv_page_in() fails after kvmppc_uvmem_get_page() succeeds, a secure device page is leaked. The function kvmppc_uvmem_get_page() allocates resources but they are not properly released on failure, causing permanent consumption of secure memory pool entries and leaving GFN marked as secure.

Detection Guidance

This vulnerability affects KVM on POWER9/10 systems with Ultravisor/PEF. Detection requires checking kernel logs for uv_page_in() failures or secure memory pool exhaustion on affected systems. No specific commands are provided in the context.

Impact Analysis

This vulnerability can cause resource exhaustion on systems using POWER9/10 with Ultravisor/PEF. Each failure permanently consumes secure memory, reducing available secure memory for other operations. It may lead to system instability or crashes if the secure memory pool is exhausted.

Mitigation Strategies

Apply the Linux kernel patch that fixes the secure device page leak in kvmppc_svm_page_in(). Monitor systems for uv_page_in() failures and ensure Ultravisor/PEF is properly configured. Restart affected VMs after patching.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98433. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart