CVE-2026-98249

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98249", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.331Z", "datePublished": "2026-10-06T08:45:17.414Z", "dateUpdated": "2026-10-19T09:16:20.676Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:16:20.676Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc\n\nswsusp_arch_suspend_exit() reinstalls the restored kernel's hyp stub\nvectors with an hvc, but never passes the arguments. x0 is not set to\nHVC_SET_VECTORS and x1 is not set to the vector address, so the stub\ndispatch falls through and returns without writing vbar_el2. EL2 is\nleft pointing at the trans_pgd copy of the vectors, a page that\nswsusp_free() releases right after resume.\n\nSet the arguments up the same way __hyp_set_vectors() does.\n\nWithout this fix, Vladimir was able to trigger a hang when resuming from\nhibernation with CONFIG_PAGE_POISONING=y and page_poison=on."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/kernel/hibernate-asm.S"], "versions": [{"version": "788bfdd97434982b6d575062581e8e72eea755af", "lessThan": "6646418d1032cac25110526161f60d255ed08397", "status": "affected", "versionType": "git"}, {"version": "788bfdd97434982b6d575062581e8e72eea755af", "lessThan": "909e92423db7299e0206232051aa21fe129f65d0", "status": "affected", "versionType": "git"}, {"version": "788bfdd97434982b6d575062581e8e72eea755af", "lessThan": "60a3c319f1127c4d247d4ed235c5d65376d5e745", "status": "affected", "versionType": "git"}, {"version": "788bfdd97434982b6d575062581e8e72eea755af", "lessThan": "e80ea8118a073a30ebe7a31bd78938c2b1751acc", "status": "affected", "versionType": "git"}, {"version": "788bfdd97434982b6d575062581e8e72eea755af", "lessThan": "d3f8f773312af69eaf4dda106d76d6d42e4362e5", "status": "affected", "versionType": "git"}, {"version": "788bfdd97434982b6d575062581e8e72eea755af", "lessThan": "955d86e5f3b95b731991fdb84966c50b16314629", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/kernel/hibernate-asm.S"], "versions": [{"version": "5.16", "status": "affected"}, {"version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6646418d1032cac25110526161f60d255ed08397"}, {"url": "https://git.kernel.org/stable/c/909e92423db7299e0206232051aa21fe129f65d0"}, {"url": "https://git.kernel.org/stable/c/60a3c319f1127c4d247d4ed235c5d65376d5e745"}, {"url": "https://git.kernel.org/stable/c/e80ea8118a073a30ebe7a31bd78938c2b1751acc"}, {"url": "https://git.kernel.org/stable/c/d3f8f773312af69eaf4dda106d76d6d42e4362e5"}, {"url": "https://git.kernel.org/stable/c/955d86e5f3b95b731991fdb84966c50b16314629"}], "title": "arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/arm64/kernel/hibernate-asm.S"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6646418d1032cac25110526161f60d255ed08397", "status": "affected", "version": "788bfdd97434982b6d575062581e8e72eea755af", "versionType": "git"}, {"lessThan": "909e92423db7299e0206232051aa21fe129f65d0", "status": "affected", "version": "788bfdd97434982b6d575062581e8e72eea755af", "versionType": "git"}, {"lessThan": "60a3c319f1127c4d247d4ed235c5d65376d5e745", "status": "affected", "version": "788bfdd97434982b6d575062581e8e72eea755af", "versionType": "git"}, {"lessThan": "e80ea8118a073a30ebe7a31bd78938c2b1751acc", "status": "affected", "version": "788bfdd97434982b6d575062581e8e72eea755af", "versionType": "git"}, {"lessThan": "d3f8f773312af69eaf4dda106d76d6d42e4362e5", "status": "affected", "version": "788bfdd97434982b6d575062581e8e72eea755af", "versionType": "git"}, {"lessThan": "955d86e5f3b95b731991fdb84966c50b16314629", "status": "affected", "version": "788bfdd97434982b6d575062581e8e72eea755af", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/arm64/kernel/hibernate-asm.S"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc\n\nswsusp_arch_suspend_exit() reinstalls the restored kernel's hyp stub\nvectors with an hvc, but never passes the arguments. x0 is not set to\nHVC_SET_VECTORS and x1 is not set to the vector address, so the stub\ndispatch falls through and returns without writing vbar_el2. EL2 is\nleft pointing at the trans_pgd copy of the vectors, a page that\nswsusp_free() releases right after resume.\n\nSet the arguments up the same way __hyp_set_vectors() does.\n\nWithout this fix, Vladimir was able to trigger a hang when resuming from\nhibernation with CONFIG_PAGE_POISONING=y and page_poison=on."}], "id": "CVE-2026-98249", "lastModified": "2026-10-19T10:18:25.797", "metrics": {}, "published": "2026-10-06T09:18:13.290", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/60a3c319f1127c4d247d4ed235c5d65376d5e745"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6646418d1032cac25110526161f60d255ed08397"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/909e92423db7299e0206232051aa21fe129f65d0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/955d86e5f3b95b731991fdb84966c50b16314629"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d3f8f773312af69eaf4dda106d76d6d42e4362e5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e80ea8118a073a30ebe7a31bd78938c2b1751acc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc", "id": "2546446", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546446"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\narm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc\nswsusp_arch_suspend_exit() reinstalls the restored kernel's hyp stub\nvectors with an hvc, but never passes the arguments. x0 is not set to\nHVC_SET_VECTORS and x1 is not set to the vector address, so the stub\ndispatch falls through and returns without writing vbar_el2. EL2 is\nleft pointing at the trans_pgd copy of the vectors, a page that\nswsusp_free() releases right after resume.\nSet the arguments up the same way __hyp_set_vectors() does.\nWithout this fix, Vladimir was able to trigger a hang when resuming from\nhibernation with CONFIG_PAGE_POISONING=y and page_poison=on.", "A flaw was found in the Linux kernel. This vulnerability may allow a local privileged user to cause a Denial of Service (DoS) on ARM64 systems. When resuming from hibernation, the kernel fails to supply the required parameters when resetting hypervisor exception vectors, leaving the hypervisor pointing to memory pages that are released immediately afterward. Accessing this freed memory during resume can lead to memory corruption and trigger a system hang."], "name": "CVE-2026-98249", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98249\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98249\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98249.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[788bfdd97434982b6d575062581e8e72eea755af,6646418d1032cac25110526161f60d255ed08397)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[788bfdd97434982b6d575062581e8e72eea755af,909e92423db7299e0206232051aa21fe129f65d0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[788bfdd97434982b6d575062581e8e72eea755af,60a3c319f1127c4d247d4ed235c5d65376d5e745)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[788bfdd97434982b6d575062581e8e72eea755af,e80ea8118a073a30ebe7a31bd78938c2b1751acc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[788bfdd97434982b6d575062581e8e72eea755af,d3f8f773312af69eaf4dda106d76d6d42e4362e5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[788bfdd97434982b6d575062581e8e72eea755af,955d86e5f3b95b731991fdb84966c50b16314629)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.54,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T14:30:07.739609+00:00", "updated": "2026-10-11T18:45:19.290847+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}