CVE-2026-98713
Received Received - Intake

KVM: arm64 Fine-Grained UNDEFs Without FEAT_FGT

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT FGUs don't actually require hardware support, so don't gate fgt trap config insertion on FGT. This is the only action required to allow FGUs always, as kvm_calculate_traps() already computes the FGU bits with or without FEAT_FGT. This also fixes a spurious WARN when a TLBI OS is run on a guest in vEL1 without FEAT_TLBIOS on non FEAT_FGT hardware. In this configuration the course-grained HCR_EL2.TTLBOS trap reaches the handler handle_tlbi_el1(), which expects an EL1 TLBI only from vEL2. With FGUs enabled the UNDEF will be injected without needing the specific handler. [oliver: Take Wei-Lin's suggested changelog]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98713
EUVD
EUVD-2026-103967

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux f5a5a406b4b8bb6c1fc7a1e92a872bd86061a53f
Linux Linux f5a5a406b4b8bb6c1fc7a1e92a872bd86061a53f
Linux Linux f5a5a406b4b8bb6c1fc7a1e92a872bd86061a53f
Linux Linux f5a5a406b4b8bb6c1fc7a1e92a872bd86061a53f
Linux Linux 6.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's KVM (Kernel-based Virtual Machine) implementation for arm64. It involves the handling of fine-grained undefined instructions (FGUs) without requiring FEAT_FGT hardware support. The issue was that FGUs were incorrectly gated by FEAT_FGT, which is unnecessary. This change ensures FGUs are always enabled, fixing a spurious warning during TLBI operations in guests without FEAT_TLBIOS on non-FEAT_FGT hardware.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM arm64 implementation and does not have a direct detection method via network or system commands. It requires checking kernel version and configuration for KVM arm64 features. Review kernel logs for spurious WARN messages related to TLBI operations in guests.

Impact Analysis

This vulnerability primarily affects virtualization environments using KVM on arm64 systems. It may cause unexpected behavior or warnings during virtual machine operations, particularly when handling translation lookaside buffer invalidation (TLBI) instructions. Users might experience guest crashes or instability in systems without FEAT_FGT hardware support.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Ensure your kernel version includes the fix for KVM arm64 FGUs without FEAT_FGT dependency. Monitor for related WARN messages in logs and update KVM configurations accordingly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98713. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart