CVE-2026-98469 Overview
CVE-2026-98469 is a Linux kernel vulnerability in the KVM (Kernel-based Virtual Machine) subsystem for arm64. The flaw affects how AArch32 guests access the DBGBXVR<n> debug breakpoint value register. A consolidation of breakpoint and watchpoint register accessors routed DBGBXVR<n> through trap_dbg_wb_reg(), which uses demux_wb_reg() to select backing storage. That demux only handles Op2 values 4 through 7, but DBGBXVR<n> uses Op2 1. The mismatch causes an AArch32 guest access to hit KVM_BUG_ON(), marking the virtual machine dead.
Critical Impact
An AArch32 guest can crash its own virtual machine by accessing DBGBXVR<n>, resulting in denial of service to the guest workload running on arm64 KVM hosts.
Affected Products
- Linux kernel arm64 KVM subsystem
- Hosts running AArch32 guests on arm64 hardware
- Kernel versions containing the breakpoint and watchpoint accessor consolidation (fixes available in stable branches)
Discovery Timeline
- 2026-10-18 - CVE-2026-98469 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-98469
Vulnerability Analysis
The vulnerability resides in the arm64 KVM debug register emulation layer. KVM intercepts guest accesses to debug registers and routes them through trap handlers that select the correct backing storage array. During a refactor that consolidated breakpoint and watchpoint register accessors, DBGBXVR<n> was moved from trap_bvr() to trap_dbg_wb_reg(). The new handler calls demux_wb_reg() to pick the backing array based on the system register's Op2 field. However, demux_wb_reg() only handles Op2 values 4 through 7, which cover DBGBVR, DBGBCR, DBGWVR, and DBGWCR. The DBGBXVR<n> register uses Op2 value 1, which falls outside the supported range. When an AArch32 guest reads or writes this register, the demux function fails its range check and triggers KVM_BUG_ON(). The macro flags the VM as dead, terminating execution. This represents a kernel logic error [CWE-670] rather than a memory safety issue.
Root Cause
The root cause is incomplete coverage of system register encodings in demux_wb_reg(). DBGBXVR<n> aliases the upper 32 bits of DBGBVR<n>_EL1[63:32], and its AA32(HI) descriptor already selects the upper half. The consolidation overlooked that Op2 1 must be mapped to the same dbg_bvr[] storage as Op2 4.
Attack Vector
Exploitation requires an AArch32 guest executing on an arm64 KVM host. A guest with permission to access debug registers triggers the fault by reading or writing DBGBXVR<n> through MCR or MRC instructions. No host-side authentication is bypassed; the impact is confined to the guest VM, which is forcibly terminated by KVM_BUG_ON().
No public proof-of-concept code is available. See the upstream commits referenced below for the exact code path and fix.
Detection Methods for CVE-2026-98469
Indicators of Compromise
- Kernel log entries containing KVM_BUG_ON warnings originating from arch/arm64/kvm/sys_regs.c or demux_wb_reg.
- Unexpected termination of AArch32 guest virtual machines on arm64 hosts, often coinciding with guest debug register access.
- dmesg output referencing a VM marked dead following a trapped debug register operation.
Detection Strategies
- Monitor host kernel ring buffers for WARN or BUG traces tied to KVM debug register trap handlers.
- Correlate guest crash events with hypervisor logs showing accesses to DBGBXVR<n> encodings (Op2 == 1).
- Audit running kernels against the fixed commit hashes 6b1bca1b1ab7, 8530a05b304d, and af6813d16ace to confirm patch status.
Monitoring Recommendations
- Centralize arm64 host kernel logs and alert on repeated KVM_BUG_ON occurrences, which indicate either exploit attempts or buggy guest firmware.
- Track AArch32 guest crash rates to surface anomalous patterns that could indicate systematic triggering of the flaw.
- Validate kernel package versions on hypervisor fleets to confirm the stable backport is deployed.
How to Mitigate CVE-2026-98469
Immediate Actions Required
- Apply the upstream Linux kernel fix that maps Op2 1 to dbg_bvr[] alongside Op2 4, restoring pre-regression behavior.
- Update to a kernel build that includes commits 6b1bca1b1ab7, 8530a05b304d, or af6813d16ace.
- Inventory arm64 KVM hosts and prioritize those running AArch32 guest workloads for patching.
Patch Information
The fix is available as three stable kernel commits that restore correct DBGBXVR<n> routing. The patch adds Op2 1 to the demux mapping so that AArch32 accesses hit the correct dbg_bvr[] backing array instead of KVM_BUG_ON(). Distribution vendors are expected to backport the change to supported stable series.
Workarounds
- Where immediate patching is not possible, restrict guest configurations to AArch64 only, which avoids the vulnerable AArch32 code path.
- Limit untrusted workloads from running inside AArch32 guests on arm64 KVM hosts until the fix is deployed.
- Isolate affected hypervisors so that a VM crash does not cascade into tenant workloads sharing the same control plane.
For technical details on the fix, review the upstream references at the Linux kernel stable tree.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
