DEBIAN-CVE-2026-98467

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race Commit 7270cc9157f4 "KVM: arm64: nv: Handle VNCREL2 invalidation from MMU notifiers" introduced VNCREL2 invalidation in both kvmnesteds2unmap and kvmnesteds2wp...

DEBIAN-CVE-2026-98465

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration KVM device ioctls are not serialized against KVMRUN. As a result, kvmriscvaiaimsicrwattr can snapshot the physical CPU and HGEI of an IMSIC VS-file before a concurrent...

DEBIAN-CVE-2026-98464

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears nextset before its final uses of the enclosing vCPU. If teardown observes nextset as false while the callback is still running,...

DEBIAN-CVE-2026-98440

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction We free the shadow S2 structures from kvmarchflushshadowall, which is a Bad Ideatm. Freeing the page tables is fair game this is what this callback is for...

CVE-2026-98863

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Re-pend GETNESTEDSTATEPAGES if getting said pages fails Re-pend GETNESTEDSTATEPAGES before exiting to userspace if getting the nested pages fails in the KVMRUN path. If userspace re-runs the vCPU, and vmcs02 holds valid...

CVE-2026-98716

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted Use the MSR permission bitmap of the active VMCB instead of assuming that KVM is always using vmcb02's bitmap when L2 is active, as KVM uses msrpm02 i...

CVE-2026-98719

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it Nullify haveruncpus when freeing the mask, particularly in the error path of sevguestinit, so that KVM doesn't have to subtly use sev-active to track whether or not t...

CVE-2026-98720

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified Force a refresh of the vmcs02 MSR bitmap during nested VM-Enter if the runtime eVMCS controls pin, primary, secondary, etc. are being updated. If L1 isn't...

CVE-2026-98715

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Preserve TLB control i.e. pending TLB flush on failed VMRUN Don't reset the VMCB's TLB control back to "do nothing" on a failed VMRUN, as empirical testing shows that the CPU performs the requested TLB flush if and only...

CVE-2026-98718

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM before clearing SEV state Explicitly flush caches after intra-host migration before clearing "SEV active" on the source VM, as doing cache maintenance afterwards creates a tiny wind...

CVE-2026-98717

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero...

CVE-2026-98712

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Take a refcount on IRQs referenced by lastlrirq Referencing the last interrupt inserted in an LR is rather fragile, as this interrupt can vanish if a concurrently unmapped LPI. Solve this by bumping up the...

CVE-2026-98713

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Apply the fine-grained UNDEFs without FEATFGT FGUs don't actually require hardware support, so don't gate fgt trap config insertion on FGT. This is the only action required to allow FGUs always, as kvmcalculatetraps...

CVE-2026-98714

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update control fields on VMEXIT if and only if VMRUN succeeded Leave control.erapctl and control.clean as-is in the VMCS if VMRUN fails, because as per AMD: there's no explicit architectural guarantee about the behavior...

CVE-2026-98649

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix race in destroypagescrste Use READONCE in destroypagescrste to read the crste, avoid dereferencing the pointer multiple times...

CVE-2026-98653

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix gaccessshadowfault In some circumstances, it is possible that the page of nested guest memory that is being shadowed is not present at all in the parent guest gmap. datentrywalk will not find any leaf entry and...

CVE-2026-98652

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Add missing srcu in kvms390setirqstate Like kvms390injectvcpu, kvms390setirqstate also needs the kvm-srcu or the slots lock when performing the Store status operation. Fix by taking kvm-srcu in kvms390setirqstate...

CVE-2026-98650

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix potential races in dat skey functions When datcondsetstoragekey finds a large page, it will conditionally set the storage key in absolute memory using largecrstetophys to get the absolute address. There is a race...

CVE-2026-98651

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Properly handle NULL pointer in datcondsetstoragekey Some callers pass NULL as oldkey. Calling pagecondsetstoragekey will cause that NULL pointer to get dereferenced. Fix by checking for NULL and assigning the pointer ...

CVE-2026-98639

In the Linux kernel, the following vulnerability has been resolved: KVM: riscv: Fix NACL hfence entry update order The SBI v3.0 specification section 15.1.2 requires a nested HFENCE entry to be populated as follows: 1 find an unused entry with Config.Pending == 0 2 update the PageNumber and...