EUVD-2026-103710

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode kvmpkvmioctlallowed WARNs when kvmgetcapforkvmioctl doesn't find the ioctl number in vmioctlcaps, and kvmarchvmioctl calls it for every number the generic code doesn...

CVE-2026-98468

The Linux kernel KVM subsystem for arm64 architecture contains a benign race condition in the stage 2 page table teardown process. Under memory pressure, a race between an MMU notifier for host invalidation (triggered by migration/compaction) and the L0 host's teardown of stage 2 page tables can ...

CVE-2026-98468 KVM: arm64: Fix spurious warning for benign stage 2 teardown race

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix spurious warning for benign stage 2 teardown race kvmtool was used to establish an L1 guest with 8 CPUs and 8 GiB of RAM, an L2 guest with 4 CPUs and 4 GiB of RAM and an L3 guest with 2 CPUs and 2 GiB of RAM, all ...

CVE-2026-98468 KVM: arm64: Fix spurious warning for benign stage 2 teardown race

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix spurious warning for benign stage 2 teardown race kvmtool was used to establish an L1 guest with 8 CPUs and 8 GiB of RAM, an L2 guest with 4 CPUs and 4 GiB of RAM and an L3 guest with 2 CPUs and 2 GiB of RAM, all ...

EUVD-2026-103708

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix spurious warning for benign stage 2 teardown race kvmtool was used to establish an L1 guest with 8 CPUs and 8 GiB of RAM, an L2 guest with 4 CPUs and 4 GiB of RAM and an L3 guest with 2 CPUs and 2 GiB of RAM, all ...

EUVD-2026-103707

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race Commit 7270cc9157f4 "KVM: arm64: nv: Handle VNCREL2 invalidation from MMU notifiers" introduced VNCREL2 invalidation in both kvmnesteds2unmap and kvmnesteds2wp...

CVE-2026-98467

The Linux kernel contains a vulnerability in the KVM subsystem for arm64 architectures. A race condition occurs during the teardown of a nested guest, where the kvm->arch.mmu.pgt can be set to NULL concurrently with kvm_nested_s2_unmap() and kvm_nested_s2_wp() operations. Specifically, stage2_...

CVE-2026-98467 KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race Commit 7270cc9157f4 "KVM: arm64: nv: Handle VNCREL2 invalidation from MMU notifiers" introduced VNCREL2 invalidation in both kvmnesteds2unmap and kvmnesteds2wp...

CVE-2026-98467 KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race Commit 7270cc9157f4 "KVM: arm64: nv: Handle VNCREL2 invalidation from MMU notifiers" introduced VNCREL2 invalidation in both kvmnesteds2unmap and kvmnesteds2wp...

EUVD-2026-103706

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 fixhostownership walks only the linear-map alias of each memblock region, and the per-CPU hyp stack, mapped in the private VA range for its guard page, has none. Wa...

CVE-2026-98465

A flaw in the Linux kernel 's KVM subsystem for the RISC-V architecture allows a local user with KVM interface access to trigger a race condition during concurrent vCPU migration. Because KVM device ioctls are not serialized against KVM_RUN , the kvm_riscv_aia_imsic_rw_attr() function can snapsho...

CVE-2026-98465 RISC-V: KVM: Serialize IMSIC attributes with vCPU migration

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration KVM device ioctls are not serialized against KVMRUN. As a result, kvmriscvaiaimsicrwattr can snapshot the physical CPU and HGEI of an IMSIC VS-file before a concurrent...

EUVD-2026-103705

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration KVM device ioctls are not serialized against KVMRUN. As a result, kvmriscvaiaimsicrwattr can snapshot the physical CPU and HGEI of an IMSIC VS-file before a concurrent...

CVE-2026-98465 RISC-V: KVM: Serialize IMSIC attributes with vCPU migration

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration KVM device ioctls are not serialized against KVMRUN. As a result, kvmriscvaiaimsicrwattr can snapshot the physical CPU and HGEI of an IMSIC VS-file before a concurrent...

CVE-2026-98464 RISC-V: KVM: Synchronize hrtimer callback during teardown

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears nextset before its final uses of the enclosing vCPU. If teardown observes nextset as false while the callback is still running,...

CVE-2026-98464

A use-after-free vulnerability exists in the Linux kernel 's KVM implementation for the RISC-V architecture. A race condition occurs during virtual machine teardown where a non-Sstc hrtimer callback clears the next_set flag before its final use of the enclosing vCPU . This allows kvm_riscv_vcpu_t...

EUVD-2026-103704

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears nextset before its final uses of the enclosing vCPU. If teardown observes nextset as false while the callback is still running,...

CVE-2026-98464 RISC-V: KVM: Synchronize hrtimer callback during teardown

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears nextset before its final uses of the enclosing vCPU. If teardown observes nextset as false while the callback is still running,...

EUVD-2026-103703

In the Linux kernel, the following vulnerability has been resolved: schedext: Derive SCXRQINWAKEUP from the core enqueue flags scheduledeferredlocked skips scheduling a deferred action while SCXRQINWAKEUP is set and relies on the taskwokenscx call that follows a wakeup enqueue to run it...

CVE-2026-98463

The Linux kernel contains a vulnerability within the sched_ext framework where SCX_RQ_IN_WAKEUP is incorrectly derived from merged enqueue flags. Specifically, move_remote_task_to_local_dsq() sets this flag without a subsequent task_woken_scx() call, causing deferred actions to remain pending. Th...