CVE-2026-98638
Linux: KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()
Linux LinuxOperating systemsCVSS
NoneNot scoredExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2a2eb10795a1e495aebc7f829ccecb72c05b4fd9LinuxCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()
pkvm_vcpu_init_sve() clamps only the upper bound of the host-provided sve_max_vl, so an invalid vector length reaches sve_state_size_from_vl() and the WARN_ON() there, which is fatal at EL2. The existing !sve_state_size test rejects such a length, but only after the macro has run.
Check sve_vl_valid() before deriving the state size. A valid length cannot yield a zero size, so the !sve_state_size test goes with it.
Text from CVE List
Affected versions 8
- Linuxaffected: 5db1bef933427aa467ad89c7b695a84a6b4afe16 before faf66e55e87498ab4bf88cdf9a629e61b3f2d3bcCVE List
- Linuxaffected: 5db1bef933427aa467ad89c7b695a84a6b4afe16 before bae3e4493046de4fefa15f809d9b8dc114e84a3dCVE List
- Linuxaffected: 5db1bef933427aa467ad89c7b695a84a6b4afe16 before 2a2eb10795a1e495aebc7f829ccecb72c05b4fd9CVE List
- Linuxaffected: 6.16CVE List
- Linuxunaffected: all versions before 6.16CVE List
- Linuxunaffected: 6.18.55 through 6.18.*CVE List
- Linuxunaffected: 7.2.9 through 7.2.*CVE List
- Linuxunaffected: 7.3CVE List