CVE-2026-98467
Received Received - Intake

Null Pointer Dereference in Linux Kernel KVM

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race Commit 7270cc9157f4 ("KVM: arm64: nv: Handle VNCR_EL2 invalidation from MMU notifiers") introduced VNCR_EL2 invalidation in both kvm_nested_s2_unmap() and kvm_nested_s2_wp(). However at the point of this being performed concurrent stage 2 teardown of a nested guest can cause kvm->arch.mmu.pgt to be set to NULL. This happens in kvm_flush_shadow_all() -> kvm_arch_flush_shadow_all() -> kvm_free_stage2_pgd() and is performed under the kvm->mmu_lock. Commit ec14c272408a ("KVM: arm64: nv: Unmap/flush shadow stage 2 page tables") introduced the teardown of the entire nested MMU range, which then invokes stage2_apply_range() with resched=true: mmu_notifier_invalidate_range_start() -> ... -> kvm_mmu_notifier_invalidate_range_start() -> kvm_mmu_unmap_gfn_range() -> kvm_unmap_gfn_range() -> kvm_nested_s2_unmap() -> kvm_stage2_unmap_range() -> __unmap_stage2_range() -> stage2_apply_range() This means that stage2_apply_range() can drop the kvm->mmu_lock and thus concurrent progress can be made in lockstep with kvm_arch_flush_shadow_all(). If kvm_arch_flush_shadow_all() advances ahead of stage2_apply_range() and completes its operation it guarantees a NULL pointer deref. Since kvm_free_stage2_pgd() is performed under the kvm->mmu_lock this will either be observed NULL or not and serialised against kvm_free_stage2_pgd(). Resolve the issue by abstracting the invalidation to a new function, kvm_invalidate_vncr_ipa_all(), and check that the pgt is non-NULL before dereferencing it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98467
EUVD
EUVD-2026-103707

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux 7270cc9157f474dfc46750a34c9d7defc686b2eb
Linux Linux 7270cc9157f474dfc46750a34c9d7defc686b2eb
Linux Linux 7270cc9157f474dfc46750a34c9d7defc686b2eb
Linux Linux 6.16

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a null pointer dereference vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) implementation for ARM64 nested virtualization. It occurs when a race condition happens between nested guest stage 2 page table teardown and VNCR_EL2 invalidation. The issue arises because concurrent operations can set the page table pointer to NULL while another process attempts to use it, leading to a crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM implementation for arm64 nested virtualization. Detection requires checking kernel logs for null pointer dereference errors related to KVM operations or monitoring for crashes in virtualization workloads.

Impact Analysis

This vulnerability could cause a denial of service by crashing the host system running the vulnerable Linux kernel. It specifically affects systems using KVM for ARM64 nested virtualization, potentially leading to guest VMs becoming unresponsive or the entire host system rebooting.

Mitigation Strategies

Apply the kernel patch that resolves this issue by updating to a version containing commit 7270cc9157f4 or later. If immediate patching is not possible, disable nested virtualization for arm64 guests as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98467. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart