CVE-2026-98467: Linux Kernel KVM Race Condition Vulnerability

CVE-2026-98467 Overview

CVE-2026-98467 is a null pointer dereference vulnerability in the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem for arm64 architectures. The flaw affects nested virtualization code paths that handle VNCR_EL2 invalidation from Memory Management Unit (MMU) notifiers. A race condition between kvm_nested_s2_unmap() or kvm_nested_s2_wp() operations and concurrent stage 2 teardown allows kvm->arch.mmu.pgt to become NULL while still being dereferenced. The condition arises because stage2_apply_range() can drop the kvm->mmu_lock to reschedule, enabling kvm_arch_flush_shadow_all() to free the page table concurrently.

Critical Impact
A race during nested guest teardown can trigger a kernel null pointer dereference, resulting in a kernel oops and host-level denial of service on arm64 systems using KVM nested virtualization.

Affected Products

Linux kernel versions that include commit 7270cc9157f4 ("KVM: arm64: nv: Handle VNCR_EL2 invalidation from MMU notifiers")
Linux kernel versions that include commit ec14c272408a ("KVM: arm64: nv: Unmap/flush shadow stage 2 page tables")
arm64 hosts running KVM with nested virtualization enabled

Discovery Timeline

2026-10-18 - CVE-2026-98467 published to the National Vulnerability Database (NVD)
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98467

Vulnerability Analysis

The vulnerability resides in the arm64 nested virtualization support of KVM. Commit 7270cc9157f4 added VNCR_EL2 invalidation inside kvm_nested_s2_unmap() and kvm_nested_s2_wp(). Both routines dereference kvm->arch.mmu.pgt when invalidating shadow mappings for a nested guest.

Concurrently, teardown of a nested guest executes kvm_flush_shadow_all(), which calls kvm_arch_flush_shadow_all() and kvm_free_stage2_pgd(). This path sets kvm->arch.mmu.pgt to NULL under the kvm->mmu_lock. A race window opens because stage2_apply_range() is invoked with resched=true, allowing it to drop the mmu_lock mid-operation to permit rescheduling.

Root Cause

The root cause is unsafe concurrent access to a shared page table pointer. The MMU notifier chain mmu_notifier_invalidate_range_start() → kvm_mmu_notifier_invalidate_range_start() → kvm_mmu_unmap_gfn_range() → kvm_nested_s2_unmap() → kvm_stage2_unmap_range() releases the lock during long-running stage 2 range operations. Teardown advancing in that window frees the page table before the invalidator resumes, producing a null pointer dereference [CWE-476] when execution returns to the VNCR invalidation logic.

Attack Vector

Triggering the race requires local privileges on the arm64 host sufficient to create and tear down nested KVM guests. An attacker able to orchestrate concurrent nested guest teardown alongside MMU notifier-driven invalidation can crash the host kernel. The vulnerability is not remotely exploitable over the network and does not grant code execution. Impact is confined to availability of the host system.

No public proof-of-concept code or exploitation in the wild has been reported. The Exploit Prediction Scoring System (EPSS) probability for this CVE is 0.166%.

Detection Methods for CVE-2026-98467

Indicators of Compromise

Kernel oops or panic entries referencing kvm_nested_s2_unmap, kvm_nested_s2_wp, or stage2_apply_range in dmesg or /var/log/kern.log
Null pointer dereference traces originating from the KVM arm64 nested virtualization code paths
Unexpected host reboots on arm64 systems running workloads that create and destroy nested guests

Detection Strategies

Monitor kernel crash logs and kdump captures for backtraces that include VNCR_EL2 invalidation or shadow stage 2 teardown functions
Correlate host crashes with lifecycle events of nested VMs through hypervisor and orchestrator telemetry
Audit running kernel versions across the arm64 fleet to identify hosts carrying the vulnerable commits but not the fix

Monitoring Recommendations

Enable kdump and persistent kernel log collection on arm64 KVM hosts to retain evidence after a crash
Forward kernel logs to a centralized log platform for cross-host correlation and alerting on KVM-related oops signatures
Track guest create and destroy operations alongside host uptime metrics to surface stability regressions

How to Mitigate CVE-2026-98467

Immediate Actions Required

Apply the upstream Linux kernel patches referenced below as soon as vendor-supplied kernels are available
Inventory arm64 hosts using KVM nested virtualization and prioritize them for patching
Where patching is not immediately possible, restrict the ability to create nested guests to trusted operators

Patch Information

The fix abstracts the invalidation into a new function kvm_invalidate_vncr_ipa_all() and verifies that pgt is non-NULL before dereferencing it. Because kvm_free_stage2_pgd() runs under kvm->mmu_lock, the NULL check serializes correctly against teardown. The upstream fixes are available in the following commits: Kernel Git Commit 3cefc1ab511f, Kernel Git Commit 4c74e233cde, and Kernel Git Commit 970de111c08.

Workarounds

Disable KVM nested virtualization on arm64 hosts until the patched kernel can be deployed
Avoid workloads that rapidly create and destroy nested guests, which widens the race window
Pin VM lifecycle operations to serialized orchestration paths to reduce concurrent teardown events

bash

# Verify whether nested virtualization is enabled on an arm64 KVM host
cat /sys/module/kvm/parameters/nested

# Temporarily disable KVM nested virtualization until patched kernel is deployed
modprobe -r kvm_arm
modprobe kvm_arm nested=0