All vulnerabilities
CVE-2026-98713

Linux: KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2f4a15c52a552c5244ec27f4ca8bda855594f918Also 1113374a17d7f7d16b02ee0bbd9b1e7a60cbb087, 4bdd2b3a708c1feb701cb8b62feb8ad2fd77bb07CVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 2f4a15c52a552c5244ec27f4ca8bda855594f918LinuxCVE List
  • 1113374a17d7f7d16b02ee0bbd9b1e7a60cbb087LinuxCVE List
  • 4bdd2b3a708c1feb701cb8b62feb8ad2fd77bb07LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT

FGUs don't actually require hardware support, so don't gate fgt trap config insertion on FGT. This is the only action required to allow FGUs always, as kvm_calculate_traps() already computes the FGU bits with or without FEAT_FGT.

This also fixes a spurious WARN when a TLBI OS is run on a guest in vEL1 without FEAT_TLBIOS on non FEAT_FGT hardware. In this configuration the course-grained HCR_EL2.TTLBOS trap reaches the handler handle_tlbi_el1(), which expects an EL1 TLBI only from vEL2. With FGUs enabled the UNDEF will be injected without needing the specific handler.

[oliver: Take Wei-Lin's suggested changelog]

Text from CVE List

Affected versions 10

  • Linuxaffected: f5a5a406b4b8bb6c1fc7a1e92a872bd86061a53f before 2f4a15c52a552c5244ec27f4ca8bda855594f918CVE List
  • Linuxaffected: f5a5a406b4b8bb6c1fc7a1e92a872bd86061a53f before 1113374a17d7f7d16b02ee0bbd9b1e7a60cbb087CVE List
  • Linuxaffected: f5a5a406b4b8bb6c1fc7a1e92a872bd86061a53f before af3300b3a6bace925a496f3520e171c07b999c72CVE List
  • Linuxaffected: f5a5a406b4b8bb6c1fc7a1e92a872bd86061a53f before 4bdd2b3a708c1feb701cb8b62feb8ad2fd77bb07CVE List
  • Linuxaffected: 6.9CVE List
  • Linuxunaffected: all versions before 6.9CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4