CVE-2026-98468 Overview
CVE-2026-98468 is a Linux kernel issue in the KVM arm64 subsystem. The flaw produces a spurious WARN_ON() in __unmap_stage2_range() when a stage 2 page table teardown races with an MMU notifier invalidation. The race itself is benign and handled correctly, but the kernel logs a warning that can mask real issues and trigger panic-on-warn systems. The condition was reproduced with kvmtool running nested L1, L2, and L3 guests on an arm64 host under memory pressure caused by compaction.
Critical Impact
The spurious warning can trigger a kernel panic on hosts configured with panic_on_warn, resulting in denial of service during normal KVM nested virtualization workloads under memory pressure.
Affected Products
- Linux kernel KVM arm64 subsystem (arch/arm64/kvm/mmu.c)
- Hosts running nested KVM guests on arm64 hardware
- Kernels prior to the backport commits 330346dd, 38b70fc4, c23ed110, and f44a9263
Discovery Timeline
- 2026-10-18 - CVE-2026-98468 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-98468
Vulnerability Analysis
The issue lives in stage2_apply_range() within arch/arm64/kvm/mmu.c. The function walks stage 2 page tables for a nested KVM arm64 guest and periodically calls cond_resched_rwlock_write() to yield kvm->mmu_lock. When another thread acquires the lock during that yield and performs kvm_free_stage2_pgd(), it sets mmu->pgt = NULL. When the original walker resumes, it observes the NULL pointer and returns -EINVAL. The caller __unmap_stage2_range() then triggers WARN_ON(-EINVAL), even though the teardown handled the memory correctly.
The race was reproduced using kvmtool with an L1 guest (8 CPUs, 8 GiB RAM), an L2 guest (4 CPUs, 4 GiB RAM), and an L3 guest (2 CPUs, 2 GiB RAM). Memory pressure in the L0 host invoked kcompactd0, which issued MMU notifier invalidations through mmu_notifier_invalidate_range_start() into kvm_nested_s2_unmap().
Root Cause
The walker treats concurrent page table teardown as an error condition rather than a legitimate reason to abort. When cond_resched_rwlock_write() drops kvm->mmu_lock, another thread executing kvm_mmu_notifier_release() can complete a full teardown via kvm_flush_shadow_all() before the walker re-acquires the lock. The subsequent NULL pointer check correctly aborts the walk but incorrectly surfaces -EINVAL to the caller.
Attack Vector
The condition is not remotely exploitable in the traditional sense. It is triggered by legitimate kernel activity, specifically memory compaction and process exit occurring concurrently with nested KVM guest operation on arm64. A local user running nested virtualization workloads under memory pressure can reliably reproduce the warning. On systems with panic_on_warn=1, this becomes a local denial of service.
The vulnerability manifests entirely within kernel code paths. See the referenced kernel patches for the exact logic change in stage2_apply_range().
Detection Methods for CVE-2026-98468
Indicators of Compromise
- Kernel log messages containing WARNING: arch/arm64/kvm/mmu.c:336 at __unmap_stage2_range
- Stack traces referencing kcompactd0 as the originating task
- Unexpected kernel panics on arm64 KVM hosts with panic_on_warn enabled during VM shutdown
Detection Strategies
- Monitor dmesg and /var/log/kern.log on arm64 KVM hosts for WARN_ON entries originating from __unmap_stage2_range
- Correlate warnings with memory pressure events and nested guest teardown activity
- Audit kernel versions on arm64 hypervisors to identify hosts missing the backport commits 330346dd, 38b70fc4, c23ed110, or f44a9263
Monitoring Recommendations
- Forward kernel ring buffer events to centralized log collection and alert on arch/arm64/kvm/mmu.c warnings
- Track host memory pressure metrics alongside VM lifecycle events to identify at-risk workloads
- Review sysctl kernel.panic_on_warn settings on nested virtualization hosts and document exposure
How to Mitigate CVE-2026-98468
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced below to all affected arm64 KVM hosts
- Confirm kernel.panic_on_warn is not enabled on hosts that cannot be patched immediately to prevent denial of service
- Inventory arm64 hypervisors running nested virtualization and prioritize patching based on workload criticality
Patch Information
The fix updates stage2_apply_range() so concurrent page table teardown observed after a lock release is no longer treated as an error. Only __unmap_stage2_range() consumed the error return, so this change scopes narrowly. Apply the following commits from the stable tree: Kernel Patch 330346dd, Kernel Patch 38b70fc4, Kernel Patch c23ed110, and Kernel Patch f44a9263.
Workarounds
- Disable panic_on_warn on affected arm64 KVM hosts using sysctl -w kernel.panic_on_warn=0 until the patch is applied
- Reduce host memory pressure to minimize compaction activity that triggers the race
- Avoid deeply nested KVM guest configurations on unpatched arm64 kernels where feasible
# Verify panic_on_warn is disabled while awaiting patch deployment
sysctl kernel.panic_on_warn
sysctl -w kernel.panic_on_warn=0
# Check running kernel version on arm64 KVM host
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
