Linux Kernel KVM arm64: Incorrect stage-2 ownership of hypervisor stack pages
Summary
The arm64 KVM pKVM hypervisor setup does not remove the per-CPU hypervisor stack pages from the host stage-2 mapping, because the ownership walker only visits the linear-map alias of memory. The stack pages are mapped in a separate EL2 range with a guard page, so they are missed. According to the CVSS vector, a local attacker with high privileges could read, modify or disrupt memory the host should not access. Exposure is limited to arm64 hosts with pKVM enabled.
Affected
- Linux kernel with KVM on arm64 and pKVM, from commit 1a919b17ef012 onward (CNA record)
- OSV: introduced in 5.19.0 and 6.19.0
- Exact affected ranges per stable branch are not verified; a third-party range (VulDB) could not be checked
Fixed in
- Upstream fix commits: 22df195bff84, 3a8c562892b9, e5dd2a91a7ae
- OSV: fixed in 6.18.55 and 7.2.9
- Fixed versions for your distribution: Unknown.
Workaround
Unknown.
Exploitation
- No public proof of concept or in-the-wild exploitation known.
- Ubuntu rates the CVE low priority and states that exploitation requires kernel-level access.
Our recommendation
- Check whether your arm64 hosts run KVM with pKVM enabled.
- Install the kernel update from your distribution or the fixed upstream stable release in your normal patch cycle.
- Prioritise the update if you run arm64 virtualisation hosts with pKVM or untrusted local users.
- Confirm the fixed package version in your distribution advisory.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux stable commit 22df195bff84 git.kernel.org
- Linux stable commit 3a8c562892b9 git.kernel.org
- Linux stable commit e5dd2a91a7ae git.kernel.org
- OSV: CVE-2026-98466 osv.dev
- Ubuntu security notice CVE-2026-98466 ubuntu.com
- VulDB: CVE-2026-98466 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:51.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 fix_host_ownership() walks only the linear-map alias of each memblock region, and the per-CPU hyp stack, mapped in the private VA range for its guard page, has none. Walk each stack's VA range with the same walker.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.