CVE-2026-98466

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98466", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.351Z", "datePublished": "2026-10-18T15:15:18.414Z", "dateUpdated": "2026-11-10T18:15:14.388Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-10T18:15:14.388Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Transfer the hyp stack pages out of the host stage-2\n\nfix_host_ownership() walks only the linear-map alias of each memblock\nregion, and the per-CPU hyp stack, mapped in the private VA range for\nits guard page, has none.\n\nWalk each stack's VA range with the same walker."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.2, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The local `module_init(kvm_arm_init)` path reaches `init_hyp_mode()` \u2192 `kvm_hyp_init_protection()` \u2192 `do_pkvm_init()` \u2192 `handle___pkvm_init()` \u2192 `__pkvm_init()` \u2192 `__pkvm_init_finalise()` \u2192 patched `fix_host_ownership()`. Exploitation accesses the omitted stack pages through host direct-map aliases; no wire or guest message supplies causal data.\nAC:L - With `kvm-arm.mode=protected`, the omitted pages retain host-owned state, so `handle_host_mem_abort()` \u2192 `host_stage2_idmap()` deterministically installs `PKVM_HOST_MEM_PROT` RWX mappings. The attacker controls the stack access and a following HVC; no race or external condition is required.\nPR:H - `/dev/kvm` ioctls only cause EL2 to use the stack; they do not expose `kvm_arm_hyp_stack_base` or its PFN. Writing the kernel direct-map alias requires control of host EL1 through real host-administrative privilege, unavailable through user namespaces.\nUI:N - After pKVM initialization, the host attacker can access the retained direct-map alias and invoke an HVC or `KVM_RUN` to make EL2 use the corrupted stack. No action by another user is required.\nS:C - The missing `host_stage2_set_owner_locked(..., PKVM_ID_HYP)` operation lets the host EL1 authority access the protected EL2 stack, crossing the stage-2 boundary that isolates the hypervisor and protected VMs.\nC:H - The host can read live EL2 stack contents, including saved registers and pointers. Its simultaneous write access to stack control data can hijack EL2 execution and expose hypervisor or protected-VM memory.\nI:H - The host can overwrite the active stack used by `__host_exit()` and `handle_trap()`, including saved frame and return state. Control-flow corruption at EL2 can modify hypervisor ownership metadata and protected-VM memory.\nA:H - Corrupting the per-CPU stack consumed on every host-to-EL2 trap can produce invalid returns or hypervisor faults, crashing the hypervisor and consequently the host or its protected VMs."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/kvm/hyp/nvhe/setup.c"], "versions": [{"version": "1a919b17ef012ca0572bae759c27e5ea02bfb47f", "lessThan": "6c7b5eb6f7f424f5b82d0f9469a5f5adcdf4d973", "status": "affected", "versionType": "git"}, {"version": "1a919b17ef012ca0572bae759c27e5ea02bfb47f", "lessThan": "e5dd2a91a7ae3a276e6d79806127e923936e241b", "status": "affected", "versionType": "git"}, {"version": "1a919b17ef012ca0572bae759c27e5ea02bfb47f", "lessThan": "22df195bff84300a3f04813d6148765c77ac565a", "status": "affected", "versionType": "git"}, {"version": "1a919b17ef012ca0572bae759c27e5ea02bfb47f", "lessThan": "3a8c562892b96f35bba1e00d5e455a15963bbb92", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/kvm/hyp/nvhe/setup.c"], "versions": [{"version": "5.19", "status": "affected"}, {"version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.117", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.12.117"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6c7b5eb6f7f424f5b82d0f9469a5f5adcdf4d973"}, {"url": "https://git.kernel.org/stable/c/e5dd2a91a7ae3a276e6d79806127e923936e241b"}, {"url": "https://git.kernel.org/stable/c/22df195bff84300a3f04813d6148765c77ac565a"}, {"url": "https://git.kernel.org/stable/c/3a8c562892b96f35bba1e00d5e455a15963bbb92"}], "title": "KVM: arm64: Transfer the hyp stack pages out of the host stage-2", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/arm64/kvm/hyp/nvhe/setup.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6c7b5eb6f7f424f5b82d0f9469a5f5adcdf4d973", "status": "affected", "version": "1a919b17ef012ca0572bae759c27e5ea02bfb47f", "versionType": "git"}, {"lessThan": "e5dd2a91a7ae3a276e6d79806127e923936e241b", "status": "affected", "version": "1a919b17ef012ca0572bae759c27e5ea02bfb47f", "versionType": "git"}, {"lessThan": "22df195bff84300a3f04813d6148765c77ac565a", "status": "affected", "version": "1a919b17ef012ca0572bae759c27e5ea02bfb47f", "versionType": "git"}, {"lessThan": "3a8c562892b96f35bba1e00d5e455a15963bbb92", "status": "affected", "version": "1a919b17ef012ca0572bae759c27e5ea02bfb47f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/arm64/kvm/hyp/nvhe/setup.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.19"}, {"lessThan": "5.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.117", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Transfer the hyp stack pages out of the host stage-2\n\nfix_host_ownership() walks only the linear-map alias of each memblock\nregion, and the per-CPU hyp stack, mapped in the private VA range for\nits guard page, has none.\n\nWalk each stack's VA range with the same walker."}], "id": "CVE-2026-98466", "lastModified": "2026-11-10T19:22:24.800", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.5, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-18T16:16:57.090", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/22df195bff84300a3f04813d6148765c77ac565a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3a8c562892b96f35bba1e00d5e455a15963bbb92"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6c7b5eb6f7f424f5b82d0f9469a5f5adcdf4d973"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e5dd2a91a7ae3a276e6d79806127e923936e241b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2", "id": "2554835", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554835"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.2", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-653", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nKVM: arm64: Transfer the hyp stack pages out of the host stage-2\nfix_host_ownership() walks only the linear-map alias of each memblock\nregion, and the per-CPU hyp stack, mapped in the private VA range for\nits guard page, has none.\nWalk each stack's VA range with the same walker.", "A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem on ARM64 platforms. During system initialization in protected virtualization modes, the hypervisor fails to revoke host stage-2 access permissions for per-CPU hypervisor stack memory pages. A privileged local host can exploit this flaw to inspect or alter sensitive hypervisor stack data, resulting in a bypass of hypervisor isolation and potential privilege escalation."], "name": "CVE-2026-98466", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98466\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98466\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98466.mbox"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1a919b17ef012ca0572bae759c27e5ea02bfb47f,e5dd2a91a7ae3a276e6d79806127e923936e241b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1a919b17ef012ca0572bae759c27e5ea02bfb47f,22df195bff84300a3f04813d6148765c77ac565a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1a919b17ef012ca0572bae759c27e5ea02bfb47f,3a8c562892b96f35bba1e00d5e455a15963bbb92)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T17:15:14.548095+00:00", "updated": "2026-10-20T20:45:14.329356+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}