CVE-2026-98473 s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config Three related problems exist in the handling of KVM interrupt and page resources when a queue is removed from the host's AP configuration while assigned...

CVE-2026-98473

The Linux kernel contains a vulnerability in the s390/vfio-ap driver where KVM GISC registrations and pinned guest pages are leaked when a queue is removed from the host's AP configuration while assigned to a mediated device (mdev) . This occurs because the driver fails to handle the AP_RESPONSE_...

EUVD-2026-103713

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config Three related problems exist in the handling of KVM interrupt and page resources when a queue is removed from the host's AP configuration while assigned...

EUVD-2026-103712

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Free haveruncpus during VM destruction even if VM is no longer SEV Unconditionally free SEV's "have run CPUs" cpumask in the VM destroy path, i.e. even for what appear to be non-SEV VMs, as an SEV VM becomes a non-SEV V...

CVE-2026-98471 KVM: SEV: Do cache maintenance on the source VM during intra-host migration

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM during intra-host migration Manually perform cache maintenance on the source VM during intra-host migration to ensure no stale data is left in CPU caches after the VM is destroyed...

CVE-2026-98471 KVM: SEV: Do cache maintenance on the source VM during intra-host migration

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM during intra-host migration Manually perform cache maintenance on the source VM during intra-host migration to ensure no stale data is left in CPU caches after the VM is destroyed...

CVE-2026-98471

The Linux kernel contains a vulnerability within the KVM module related to SEV (Secure Encrypted Virtualization). During an intra-host migration , the source VM is converted to a non-SEV VM, which prevents KVM's standard memory reclaim flows from triggering necessary cache maintenance. This can l...

EUVD-2026-103711

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM during intra-host migration Manually perform cache maintenance on the source VM during intra-host migration to ensure no stale data is left in CPU caches after the VM is destroyed...

EUVD-2026-103710

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode kvmpkvmioctlallowed WARNs when kvmgetcapforkvmioctl doesn't find the ioctl number in vmioctlcaps, and kvmarchvmioctl calls it for every number the generic code doesn...

EUVD-2026-103709

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix AArch32 DBGBXVR handling The consolidation of the breakpoint and watchpoint register accessors switched DBGBXVR from trapbvr to trapdbgwbreg. The latter selects backing storage with demuxwbreg, which only handles...

CVE-2026-98468 KVM: arm64: Fix spurious warning for benign stage 2 teardown race

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix spurious warning for benign stage 2 teardown race kvmtool was used to establish an L1 guest with 8 CPUs and 8 GiB of RAM, an L2 guest with 4 CPUs and 4 GiB of RAM and an L3 guest with 2 CPUs and 2 GiB of RAM, all ...

CVE-2026-98468 KVM: arm64: Fix spurious warning for benign stage 2 teardown race

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix spurious warning for benign stage 2 teardown race kvmtool was used to establish an L1 guest with 8 CPUs and 8 GiB of RAM, an L2 guest with 4 CPUs and 4 GiB of RAM and an L3 guest with 2 CPUs and 2 GiB of RAM, all ...

EUVD-2026-103708

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix spurious warning for benign stage 2 teardown race kvmtool was used to establish an L1 guest with 8 CPUs and 8 GiB of RAM, an L2 guest with 4 CPUs and 4 GiB of RAM and an L3 guest with 2 CPUs and 2 GiB of RAM, all ...

CVE-2026-98468

The Linux kernel KVM subsystem for arm64 architecture contains a benign race condition in the stage 2 page table teardown process. Under memory pressure, a race between an MMU notifier for host invalidation (triggered by migration/compaction) and the L0 host's teardown of stage 2 page tables can ...

CVE-2026-98467 KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race Commit 7270cc9157f4 "KVM: arm64: nv: Handle VNCREL2 invalidation from MMU notifiers" introduced VNCREL2 invalidation in both kvmnesteds2unmap and kvmnesteds2wp...

CVE-2026-98467 KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race Commit 7270cc9157f4 "KVM: arm64: nv: Handle VNCREL2 invalidation from MMU notifiers" introduced VNCREL2 invalidation in both kvmnesteds2unmap and kvmnesteds2wp...

CVE-2026-98467

The Linux kernel contains a vulnerability in the KVM subsystem for arm64 architectures. A race condition occurs during the teardown of a nested guest, where the kvm->arch.mmu.pgt can be set to NULL concurrently with kvm_nested_s2_unmap() and kvm_nested_s2_wp() operations. Specifically, stage2_...

EUVD-2026-103707

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race Commit 7270cc9157f4 "KVM: arm64: nv: Handle VNCREL2 invalidation from MMU notifiers" introduced VNCREL2 invalidation in both kvmnesteds2unmap and kvmnesteds2wp...

EUVD-2026-103706

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 fixhostownership walks only the linear-map alias of each memblock region, and the per-CPU hyp stack, mapped in the private VA range for its guard page, has none. Wa...

CVE-2026-98465 RISC-V: KVM: Serialize IMSIC attributes with vCPU migration

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration KVM device ioctls are not serialized against KVMRUN. As a result, kvmriscvaiaimsicrwattr can snapshot the physical CPU and HGEI of an IMSIC VS-file before a concurrent...