CVE-2026-98440 (GCVE-0-2026-98440)

Vulnerability from cvelistv5 – Published: 2026-10-18 15:14 – Updated: 2026-10-24 14:08
VLAI
Title
KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction We free the shadow S2 structures from kvm_arch_flush_shadow_all(), which is a Bad Idea(tm). Freeing the page tables is fair game (this is what this callback is for), but freeing the container that could still be referenced by another part of the system is not great. Instead, grow separate destructors that gets called when we tear the VM down for good. From there, we can nuke both the individual MMUs as well as the global array that points to them, safe in the knowledge that the vcpus themselves have been destroyed already.
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7063 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 , < 876049f026b4dfaca0cc78ec81be0e639ca8525d (git)
Affected: 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 , < 22e82acec93a681071ed36f70eabe2d0c4e0bebd (git)
Affected: 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 , < 5bf1c9175e657b3c2dc1cf77403031ac7aadcf66 (git)
Affected: 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 , < e5843f4effaa2ffac3e789ecd4456403564961d4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.113 , ≤ 6.12.* (semver)
Unaffected: 6.18.56 , ≤ 6.18.* (semver)
Unaffected: 7.2.9 , ≤ 7.2.* (semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/kvm_nested.h",
            "arch/arm64/kvm/arm.c",
            "arch/arm64/kvm/nested.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "876049f026b4dfaca0cc78ec81be0e639ca8525d",
              "status": "affected",
              "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51",
              "versionType": "git"
            },
            {
              "lessThan": "22e82acec93a681071ed36f70eabe2d0c4e0bebd",
              "status": "affected",
              "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51",
              "versionType": "git"
            },
            {
              "lessThan": "5bf1c9175e657b3c2dc1cf77403031ac7aadcf66",
              "status": "affected",
              "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51",
              "versionType": "git"
            },
            {
              "lessThan": "e5843f4effaa2ffac3e789ecd4456403564961d4",
              "status": "affected",
              "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/kvm_nested.h",
            "arch/arm64/kvm/arm.c",
            "arch/arm64/kvm/nested.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.113",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.56",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.9",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction\n\nWe free the shadow S2 structures from kvm_arch_flush_shadow_all(), which\nis a Bad Idea(tm). Freeing the page tables is fair game (this is what\nthis callback is for), but freeing the container that could still be\nreferenced by another part of the system is not great.\n\nInstead, grow separate destructors that gets called when we tear the VM\ndown for good. From there, we can nuke both the individual MMUs as well\nas the global array that points to them, safe in the knowledge that the\nvcpus themselves have been destroyed already."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Local close() of the last KVM FD reaches kvm_put_kvm() -\u003e kvm_destroy_vm() -\u003e mmu_notifier_unregister() -\u003e kvm_mmu_notifier_release() -\u003e patched kvm_arch_flush_shadow_all(), while concurrent munmap() reaches kvm_unmap_gfn_range() -\u003e kvm_nested_s2_unmap().\nAC:H - Although one process controls both close() and munmap() and stage2_apply_range() drops mmu_lock, reachability requires FEAT_NV2 hardware booted with the explicitly non-default experimental kvm-arm.mode=nested; a low-privileged attacker cannot establish that host state.\nPR:L - The setup uses KVM_CREATE_VM, KVM_CREATE_VCPU, KVM_ARM_VCPU_INIT with KVM_ARM_VCPU_HAS_EL2, and KVM_SET_USER_MEMORY_REGION; none has a capable() check, so an unprivileged local user granted /dev/kvm access suffices.\nUI:N - The attacker creates and runs the nested VM, races munmap() against closing its KVM descriptors, and needs no action from another user.\nS:U - The demonstrated attacker is a host-side /dev/kvm user and the corruption remains in that host kernel; no guest-controlled operation invokes the required close()/munmap() teardown race, so this is local kernel escalation rather than a guest escape.\nC:H - After vulnerable kvm_arch_flush_shadow_all() frees the kvm_s2_mmu block, an in-flight stage2_apply_range() rereads reclaimable mmu-\u003epgt; controlling the replacement kernel object can steer page-table memory accesses and expose arbitrary kernel data.\nI:H - The reclaimed mmu-\u003epgt pointer is passed to kvm_pgtable_stage2_unmap(), whose page-table walker modifies entries through that pointer, giving the kernel-heap use-after-free arbitrary-write and control-flow-hijacking potential.\nA:H - Dereferencing the freed kvm_s2_mmu or a reclaimed mmu-\u003epgt in stage2_apply_range() and kvm_pgtable_stage2_unmap() can produce a host kernel oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T14:08:48.611Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/876049f026b4dfaca0cc78ec81be0e639ca8525d"
        },
        {
          "url": "https://git.kernel.org/stable/c/22e82acec93a681071ed36f70eabe2d0c4e0bebd"
        },
        {
          "url": "https://git.kernel.org/stable/c/5bf1c9175e657b3c2dc1cf77403031ac7aadcf66"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5843f4effaa2ffac3e789ecd4456403564961d4"
        }
      ],
      "title": "KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98440",
    "datePublished": "2026-10-18T15:14:50.740Z",
    "dateReserved": "2026-09-25T10:25:14.349Z",
    "dateUpdated": "2026-10-24T14:08:48.611Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98440",
      "date": "2026-10-27",
      "epss": "0.00122",
      "percentile": "0.01931"
    },
    "microsoft_vex": {
      "current_release_date": "2026-10-21T18:33:08.000Z",
      "cve": "CVE-2026-98440",
      "id": "msrc_CVE-2026-98440",
      "initial_release_date": "2026-10-20T22:23:29.000Z",
      "product_status:under_investigation": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-98440.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/arm64/include/asm/kvm_nested.h",
                  "arch/arm64/kvm/arm.c",
                  "arch/arm64/kvm/nested.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "876049f026b4dfaca0cc78ec81be0e639ca8525d",
                    "status": "affected",
                    "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "22e82acec93a681071ed36f70eabe2d0c4e0bebd",
                    "status": "affected",
                    "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5bf1c9175e657b3c2dc1cf77403031ac7aadcf66",
                    "status": "affected",
                    "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e5843f4effaa2ffac3e789ecd4456403564961d4",
                    "status": "affected",
                    "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/arm64/include/asm/kvm_nested.h",
                  "arch/arm64/kvm/arm.c",
                  "arch/arm64/kvm/nested.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.11"
                  },
                  {
                    "lessThan": "6.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.113",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.56",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction\n\nWe free the shadow S2 structures from kvm_arch_flush_shadow_all(), which\nis a Bad Idea(tm). Freeing the page tables is fair game (this is what\nthis callback is for), but freeing the container that could still be\nreferenced by another part of the system is not great.\n\nInstead, grow separate destructors that gets called when we tear the VM\ndown for good. From there, we can nuke both the individual MMUs as well\nas the global array that points to them, safe in the knowledge that the\nvcpus themselves have been destroyed already."
          }
        ],
        "id": "CVE-2026-98440",
        "lastModified": "2026-10-24T14:16:41.777",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-18T16:16:54.287",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/22e82acec93a681071ed36f70eabe2d0c4e0bebd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5bf1c9175e657b3c2dc1cf77403031ac7aadcf66"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/876049f026b4dfaca0cc78ec81be0e639ca8525d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e5843f4effaa2ffac3e789ecd4456403564961d4"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-24T14:23:02+00:00",
      "cve": "CVE-2026-98440",
      "id": "CVE-2026-98440",
      "initial_release_date": "2026-10-18T00:00:00+00:00",
      "product_status:known_affected": "185",
      "product_status:known_not_affected": "93",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98440.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-19T23:50:34Z",
      "cve": "CVE-2026-98440",
      "id": "CVE-2026-98440",
      "initial_release_date": "2026-10-18T23:46:51Z",
      "product_status:known_affected": "30",
      "product_status:known_not_affected": "318",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-98440",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2026/cve-2026-98440.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.