CVE-2026-98653
Received Received - Intake

KVM: s390 Shadow Page Fault Handling Flaw

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix _gaccess_shadow_fault() In some circumstances, it is possible that the page of nested guest memory that is being shadowed is not present at all in the parent guest gmap. dat_entry_walk() will not find any leaf entry and return with -ENOENT, which will erroneously be propagated all the way to userspace. Fix by manually calling gmap_link() on the memory of the nested guest that is being shadowed if the mapping was not already present.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98653
EUVD
EUVD-2026-103567

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux e38c884df92119d96f652d51f82661dd2fc0b885
Linux Linux e38c884df92119d96f652d51f82661dd2fc0b885
Linux Linux 7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in the Linux kernel affecting the KVM (Kernel-based Virtual Machine) subsystem for s390 (IBM Z) architecture. It involves a bug in the _gaccess_shadow_fault() function where a missing page in nested guest memory causes an error (-ENOENT) to propagate to userspace incorrectly. The fix involves manually linking the nested guest memory to the parent guest's gmap if the mapping is absent.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM s390 implementation and requires kernel-level inspection. Detection involves checking kernel logs for errors related to _gaccess_shadow_fault or gmap_link failures. Use commands like dmesg | grep -i 'gaccess_shadow_fault' or journalctl -k | grep -i 'gmap_link' to identify issues.

Impact Analysis

This vulnerability could allow a guest virtual machine to crash or behave unexpectedly due to incorrect memory handling in nested virtualization scenarios. It may lead to denial-of-service conditions or instability in systems running KVM on s390 systems.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch the vulnerability. If immediate patching is not possible, consider disabling nested virtualization for s390 guests by setting the kvm nested module parameter to 0 or removing the kvm module temporarily.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98653. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart