All vulnerabilities
CVE-2026-98433

Linux: KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in8f3b7746874b39fc20e0363c9076c7787d4765baAlso 0a416ee20bcccddf91ca5b63696a23b9d11d73aaCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 8f3b7746874b39fc20e0363c9076c7787d4765baLinuxCVE List
  • 0a416ee20bcccddf91ca5b63696a23b9d11d73aaLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure

In kvmppc_svm_page_in(), if uv_page_in() fails after kvmppc_uvmem_get_page() has succeeded, the secure device page is never released. kvmppc_uvmem_get_page() sets a bit in kvmppc_uvmem_bitmap, allocates a kvmppc_uvmem_page_pvt struct, marks the GFN as KVMPPC_GFN_UVMEM_PFN, and calls zone_device_page_init() which sets refcount=1 and locks the page. The subsequent goto out_finalize skips the *mig.dst assignment, so migrate_vma_finalize() is a no-op for the page, and none of those resources are ever reclaimed.

Each occurrence permanently consumes one entry from the firmware-bounded secure memory pool (kvmppc_uvmem_bitmap), leaks pvt, and leaves the GFN marked as secure — making it unusable for the lifetime of the VM.

The twin __kvmppc_svm_page_out() already handles the analogous uv_page_out() failure correctly with unlock_page(dpage); __free_page(dpage). Apply the same pattern here: unlock_page() followed by put_page(), which chains through free_zone_device_folio() into kvmppc_uvmem_folio_free() to clear the bitmap bit, free pvt, and reset the GFN state.

Reachable whenever uv_page_in() returns an error (e.g. UV pool exhaustion) on any POWER9/10 + Ultravisor/PEF system.

Text from CVE List

Affected versions 18

  • Linuxaffected: ca9f4942670c37407bb109090eaf776ce2ccc54c before ed2f2ff63cb7e71204096e765c6d02c3b6974b95CVE List
  • Linuxaffected: ca9f4942670c37407bb109090eaf776ce2ccc54c before 8f3b7746874b39fc20e0363c9076c7787d4765baCVE List
  • Linuxaffected: ca9f4942670c37407bb109090eaf776ce2ccc54c before a933d7024359e2e566b07903d1294b84f90482aeCVE List
  • Linuxaffected: ca9f4942670c37407bb109090eaf776ce2ccc54c before c41088b2765af1e97e7bb05f906ae1823eca0388CVE List
  • Linuxaffected: ca9f4942670c37407bb109090eaf776ce2ccc54c before f3d4b2fc30c97cf8e6f8b880d2de9c17ecac7f5bCVE List
  • Linuxaffected: ca9f4942670c37407bb109090eaf776ce2ccc54c before dfb84274932737e338ff5eb27f34b4c8ecb01b50CVE List
  • Linuxaffected: ca9f4942670c37407bb109090eaf776ce2ccc54c before fcbff8008b0e08cd53b611bd0ff7e01f5b962f80CVE List
  • Linuxaffected: ca9f4942670c37407bb109090eaf776ce2ccc54c before 0a416ee20bcccddf91ca5b63696a23b9d11d73aaCVE List
  • Linuxaffected: 5.5CVE List
  • Linuxunaffected: all versions before 5.5CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8