KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-98433
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-10-18 15:16:53 UTC
Updated2026-10-19 10:18:51 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure In kvmppc_svm_page_in(), if uv_page_in() fails after kvmppc_uvmem_get_page() has succeeded, the secure device page is never released. kvmppc_uvmem_get_page() sets a bit in kvmppc_uvmem_bitmap, allocates a kvmppc_uvmem_page_pvt struct, marks the GFN as KVMPPC_GFN_UVMEM_PFN, and calls zone_device_page_init() which sets refcount=1 and locks the page. The subsequent goto out_finalize skips the *mig.dst assignment, so migrate_vma_finalize() is a no-op for the page, and none of those resources are ever reclaimed. Each occurrence permanently consumes one entry from the firmware-bounded secure memory pool (kvmppc_uvmem_bitmap), leaks pvt, and leaves the GFN marked as secure — making it unusable for the lifetime of the VM. The twin __kvmppc_svm_page_out() already handles the analogous uv_page_out() failure correctly with unlock_page(dpage); __free_page(dpage). Apply the same pattern here: unlock_page() followed by put_page(), which chains through free_zone_device_folio() into kvmppc_uvmem_folio_free() to clear the bitmap bit, free pvt, and reset the GFN state. Reachable whenever uv_page_in() returns an error (e.g. UV pool exhaustion) on any POWER9/10 + Ultravisor/PEF system.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected ca9f4942670c37407bb109090eaf776ce2ccc54c ed2f2ff63cb7e71204096e765c6d02c3b6974b95 git Not specified
CNA Linux Linux affected ca9f4942670c37407bb109090eaf776ce2ccc54c 8f3b7746874b39fc20e0363c9076c7787d4765ba git Not specified
CNA Linux Linux affected ca9f4942670c37407bb109090eaf776ce2ccc54c a933d7024359e2e566b07903d1294b84f90482ae git Not specified
CNA Linux Linux affected ca9f4942670c37407bb109090eaf776ce2ccc54c c41088b2765af1e97e7bb05f906ae1823eca0388 git Not specified
CNA Linux Linux affected ca9f4942670c37407bb109090eaf776ce2ccc54c f3d4b2fc30c97cf8e6f8b880d2de9c17ecac7f5b git Not specified
CNA Linux Linux affected ca9f4942670c37407bb109090eaf776ce2ccc54c dfb84274932737e338ff5eb27f34b4c8ecb01b50 git Not specified
CNA Linux Linux affected ca9f4942670c37407bb109090eaf776ce2ccc54c fcbff8008b0e08cd53b611bd0ff7e01f5b962f80 git Not specified
CNA Linux Linux affected ca9f4942670c37407bb109090eaf776ce2ccc54c 0a416ee20bcccddf91ca5b63696a23b9d11d73aa git Not specified
CNA Linux Linux affected 5.5 Not specified
CNA Linux Linux unaffected 5.5 semver Not specified
CNA Linux Linux unaffected 5.10.271 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.222 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.189 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.158 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.112 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.54 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.8 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/a933d7024359e2e566b07903d1294b84f90482ae 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c41088b2765af1e97e7bb05f906ae1823eca0388 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/f3d4b2fc30c97cf8e6f8b880d2de9c17ecac7f5b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/fcbff8008b0e08cd53b611bd0ff7e01f5b962f80 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/0a416ee20bcccddf91ca5b63696a23b9d11d73aa 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/dfb84274932737e338ff5eb27f34b4c8ecb01b50 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/8f3b7746874b39fc20e0363c9076c7787d4765ba 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ed2f2ff63cb7e71204096e765c6d02c3b6974b95 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report