All vulnerabilities
CVE-2026-98440

Linux: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.0High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in876049f026b4dfaca0cc78ec81be0e639ca8525dAlso 22e82acec93a681071ed36f70eabe2d0c4e0bebd, 5bf1c9175e657b3c2dc1cf77403031ac7aadcf66CVE List
Published18 Oct 2026Updated 24 Oct 2026CVE List

What fixes it

  • 876049f026b4dfaca0cc78ec81be0e639ca8525dLinuxCVE List
  • 22e82acec93a681071ed36f70eabe2d0c4e0bebdLinuxCVE List
  • 5bf1c9175e657b3c2dc1cf77403031ac7aadcf66LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction

We free the shadow S2 structures from kvm_arch_flush_shadow_all(), which is a Bad Idea(tm). Freeing the page tables is fair game (this is what this callback is for), but freeing the container that could still be referenced by another part of the system is not great.

Instead, grow separate destructors that gets called when we tear the VM down for good. From there, we can nuke both the individual MMUs as well as the global array that points to them, safe in the knowledge that the vcpus themselves have been destroyed already.

Text from CVE List

Affected versions 10

  • Linuxaffected: 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 before 876049f026b4dfaca0cc78ec81be0e639ca8525dCVE List
  • Linuxaffected: 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 before 22e82acec93a681071ed36f70eabe2d0c4e0bebdCVE List
  • Linuxaffected: 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 before 5bf1c9175e657b3c2dc1cf77403031ac7aadcf66CVE List
  • Linuxaffected: 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 before e5843f4effaa2ffac3e789ecd4456403564961d4CVE List
  • Linuxaffected: 6.11CVE List
  • Linuxunaffected: all versions before 6.11CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4