CVE-2026-98440

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98440", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.349Z", "datePublished": "2026-10-18T15:14:50.740Z", "dateUpdated": "2026-10-24T14:08:48.611Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:08:48.611Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction\n\nWe free the shadow S2 structures from kvm_arch_flush_shadow_all(), which\nis a Bad Idea(tm). Freeing the page tables is fair game (this is what\nthis callback is for), but freeing the container that could still be\nreferenced by another part of the system is not great.\n\nInstead, grow separate destructors that gets called when we tear the VM\ndown for good. From there, we can nuke both the individual MMUs as well\nas the global array that points to them, safe in the knowledge that the\nvcpus themselves have been destroyed already."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Local close() of the last KVM FD reaches kvm_put_kvm() -> kvm_destroy_vm() -> mmu_notifier_unregister() -> kvm_mmu_notifier_release() -> patched kvm_arch_flush_shadow_all(), while concurrent munmap() reaches kvm_unmap_gfn_range() -> kvm_nested_s2_unmap().\nAC:H - Although one process controls both close() and munmap() and stage2_apply_range() drops mmu_lock, reachability requires FEAT_NV2 hardware booted with the explicitly non-default experimental kvm-arm.mode=nested; a low-privileged attacker cannot establish that host state.\nPR:L - The setup uses KVM_CREATE_VM, KVM_CREATE_VCPU, KVM_ARM_VCPU_INIT with KVM_ARM_VCPU_HAS_EL2, and KVM_SET_USER_MEMORY_REGION; none has a capable() check, so an unprivileged local user granted /dev/kvm access suffices.\nUI:N - The attacker creates and runs the nested VM, races munmap() against closing its KVM descriptors, and needs no action from another user.\nS:U - The demonstrated attacker is a host-side /dev/kvm user and the corruption remains in that host kernel; no guest-controlled operation invokes the required close()/munmap() teardown race, so this is local kernel escalation rather than a guest escape.\nC:H - After vulnerable kvm_arch_flush_shadow_all() frees the kvm_s2_mmu block, an in-flight stage2_apply_range() rereads reclaimable mmu->pgt; controlling the replacement kernel object can steer page-table memory accesses and expose arbitrary kernel data.\nI:H - The reclaimed mmu->pgt pointer is passed to kvm_pgtable_stage2_unmap(), whose page-table walker modifies entries through that pointer, giving the kernel-heap use-after-free arbitrary-write and control-flow-hijacking potential.\nA:H - Dereferencing the freed kvm_s2_mmu or a reclaimed mmu->pgt in stage2_apply_range() and kvm_pgtable_stage2_unmap() can produce a host kernel oops or panic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/include/asm/kvm_nested.h", "arch/arm64/kvm/arm.c", "arch/arm64/kvm/nested.c"], "versions": [{"version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51", "lessThan": "876049f026b4dfaca0cc78ec81be0e639ca8525d", "status": "affected", "versionType": "git"}, {"version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51", "lessThan": "22e82acec93a681071ed36f70eabe2d0c4e0bebd", "status": "affected", "versionType": "git"}, {"version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51", "lessThan": "5bf1c9175e657b3c2dc1cf77403031ac7aadcf66", "status": "affected", "versionType": "git"}, {"version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51", "lessThan": "e5843f4effaa2ffac3e789ecd4456403564961d4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/include/asm/kvm_nested.h", "arch/arm64/kvm/arm.c", "arch/arm64/kvm/nested.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/876049f026b4dfaca0cc78ec81be0e639ca8525d"}, {"url": "https://git.kernel.org/stable/c/22e82acec93a681071ed36f70eabe2d0c4e0bebd"}, {"url": "https://git.kernel.org/stable/c/5bf1c9175e657b3c2dc1cf77403031ac7aadcf66"}, {"url": "https://git.kernel.org/stable/c/e5843f4effaa2ffac3e789ecd4456403564961d4"}], "title": "KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/arm64/include/asm/kvm_nested.h", "arch/arm64/kvm/arm.c", "arch/arm64/kvm/nested.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "876049f026b4dfaca0cc78ec81be0e639ca8525d", "status": "affected", "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51", "versionType": "git"}, {"lessThan": "22e82acec93a681071ed36f70eabe2d0c4e0bebd", "status": "affected", "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51", "versionType": "git"}, {"lessThan": "5bf1c9175e657b3c2dc1cf77403031ac7aadcf66", "status": "affected", "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51", "versionType": "git"}, {"lessThan": "e5843f4effaa2ffac3e789ecd4456403564961d4", "status": "affected", "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/arm64/include/asm/kvm_nested.h", "arch/arm64/kvm/arm.c", "arch/arm64/kvm/nested.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction\n\nWe free the shadow S2 structures from kvm_arch_flush_shadow_all(), which\nis a Bad Idea(tm). Freeing the page tables is fair game (this is what\nthis callback is for), but freeing the container that could still be\nreferenced by another part of the system is not great.\n\nInstead, grow separate destructors that gets called when we tear the VM\ndown for good. From there, we can nuke both the individual MMUs as well\nas the global array that points to them, safe in the knowledge that the\nvcpus themselves have been destroyed already."}], "id": "CVE-2026-98440", "lastModified": "2026-10-24T14:16:41.777", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-18T16:16:54.287", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/22e82acec93a681071ed36f70eabe2d0c4e0bebd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5bf1c9175e657b3c2dc1cf77403031ac7aadcf66"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/876049f026b4dfaca0cc78ec81be0e639ca8525d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e5843f4effaa2ffac3e789ecd4456403564961d4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction", "id": "2554866", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554866"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.6", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-826", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nKVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction\nWe free the shadow S2 structures from kvm_arch_flush_shadow_all(), which\nis a Bad Idea(tm). Freeing the page tables is fair game (this is what\nthis callback is for), but freeing the container that could still be\nreferenced by another part of the system is not great.\nInstead, grow separate destructors that gets called when we tear the VM\ndown for good. From there, we can nuke both the individual MMUs as well\nas the global array that points to them, safe in the knowledge that the\nvcpus themselves have been destroyed already.", "A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem on ARM64 architectures. In nested virtualization configurations, shadow memory management structures are prematurely freed during shadow page flushes while other parts of the system may still reference them. A local user with permissions to run virtual machines can exploit this flaw to trigger a use-after-free condition, resulting in a denial of service (DoS) via a system crash or potential memory corruption."], "name": "CVE-2026-98440", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98440\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98440\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98440.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4f128f8e1aaac189f83d0f828bcdb2986d8d2e51,876049f026b4dfaca0cc78ec81be0e639ca8525d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4f128f8e1aaac189f83d0f828bcdb2986d8d2e51,22e82acec93a681071ed36f70eabe2d0c4e0bebd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4f128f8e1aaac189f83d0f828bcdb2986d8d2e51,5bf1c9175e657b3c2dc1cf77403031ac7aadcf66)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4f128f8e1aaac189f83d0f828bcdb2986d8d2e51,e5843f4effaa2ffac3e789ecd4456403564961d4)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T17:30:16.960537+00:00", "updated": "2026-10-24T15:30:14.543359+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}