All vulnerabilities
CVE-2026-98283

Linux: KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4d8f7b1f586375df8bce23a0909566ad5e852259Also 24b634852413229bb8340d908b115c3365f3a247, 51938dfa8a51a4f85328413fca9b6e21f9d2d088CVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 4d8f7b1f586375df8bce23a0909566ad5e852259LinuxCVE List
  • 24b634852413229bb8340d908b115c3365f3a247LinuxCVE List
  • 51938dfa8a51a4f85328413fca9b6e21f9d2d088LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()

kvmhv_emulate_tlbie_all_lpid() iterates the nested-guest IDR and drops mmu_lock before calling kvmhv_emulate_tlbie_lpid(), but does not hold a reference on the kvm_nested_guest pointer obtained from the IDR. A concurrent vCPU issuing a single-LPID tlbie (is=2, ric=2) can race through kvmhv_flush_nested() -> kvmhv_remove_nested() -> idr_remove / --refcnt -> kvmhv_release_nested() -> kfree(gp) in that window, leaving the iterating vCPU with a dangling pointer. The subsequent mutex_lock(&gp->tlb_lock) and accesses to gp->shadow_pgtable, gp->shadow_lpid and gp->l1_host all touch freed memory. The free path is fully L1-controlled.

Fix this by incrementing gp->refcnt inside the loop before dropping mmu_lock, mirroring what kvmhv_get_nested() does, and releasing the reference with kvmhv_put_nested() after the per-guest work completes. This is the same get/put discipline already used at every other call site that drops mmu_lock while holding a nested-guest pointer.

Text from CVE List

Affected versions 14

  • Linuxaffected: e3b6b4661527e821ffbe3db83952fdb1e6e47c49 before 4d8f7b1f586375df8bce23a0909566ad5e852259CVE List
  • Linuxaffected: e3b6b4661527e821ffbe3db83952fdb1e6e47c49 before e37fba1ba69385cff2d0e60b371ee19e7d1852d1CVE List
  • Linuxaffected: e3b6b4661527e821ffbe3db83952fdb1e6e47c49 before 24b634852413229bb8340d908b115c3365f3a247CVE List
  • Linuxaffected: e3b6b4661527e821ffbe3db83952fdb1e6e47c49 before fbf69b7d0555ee83c871f58750770f74b7179ad1CVE List
  • Linuxaffected: e3b6b4661527e821ffbe3db83952fdb1e6e47c49 before ec2d7a52b3996ae81131617b4afc0af31583c1b4CVE List
  • Linuxaffected: e3b6b4661527e821ffbe3db83952fdb1e6e47c49 before 51938dfa8a51a4f85328413fca9b6e21f9d2d088CVE List
  • Linuxaffected: 4.20CVE List
  • Linuxunaffected: all versions before 4.20CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 6