{"api_version":"1","generated_at":"2026-10-24T16:08:27+00:00","cve":"CVE-2026-98440","urls":{"html":"https://cve.report/CVE-2026-98440","api":"https://cve.report/api/cve/CVE-2026-98440.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98440","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98440"},"summary":{"title":"KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction\n\nWe free the shadow S2 structures from kvm_arch_flush_shadow_all(), which\nis a Bad Idea(tm). Freeing the page tables is fair game (this is what\nthis callback is for), but freeing the container that could still be\nreferenced by another part of the system is not great.\n\nInstead, grow separate destructors that gets called when we tear the VM\ndown for good. From there, we can nuke both the individual MMUs as well\nas the global array that points to them, safe in the knowledge that the\nvcpus themselves have been destroyed already.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-18 16:16:54","updated_at":"2026-10-24 14:16:41"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/5bf1c9175e657b3c2dc1cf77403031ac7aadcf66","name":"https://git.kernel.org/stable/c/5bf1c9175e657b3c2dc1cf77403031ac7aadcf66","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/22e82acec93a681071ed36f70eabe2d0c4e0bebd","name":"https://git.kernel.org/stable/c/22e82acec93a681071ed36f70eabe2d0c4e0bebd","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/876049f026b4dfaca0cc78ec81be0e639ca8525d","name":"https://git.kernel.org/stable/c/876049f026b4dfaca0cc78ec81be0e639ca8525d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e5843f4effaa2ffac3e789ecd4456403564961d4","name":"https://git.kernel.org/stable/c/e5843f4effaa2ffac3e789ecd4456403564961d4","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98440","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98440","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 876049f026b4dfaca0cc78ec81be0e639ca8525d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 22e82acec93a681071ed36f70eabe2d0c4e0bebd git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 5bf1c9175e657b3c2dc1cf77403031ac7aadcf66 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 e5843f4effaa2ffac3e789ecd4456403564961d4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.11","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.11 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.113 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.56 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.9 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/arm64/include/asm/kvm_nested.h","arch/arm64/kvm/arm.c","arch/arm64/kvm/nested.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"876049f026b4dfaca0cc78ec81be0e639ca8525d","status":"affected","version":"4f128f8e1aaac189f83d0f828bcdb2986d8d2e51","versionType":"git"},{"lessThan":"22e82acec93a681071ed36f70eabe2d0c4e0bebd","status":"affected","version":"4f128f8e1aaac189f83d0f828bcdb2986d8d2e51","versionType":"git"},{"lessThan":"5bf1c9175e657b3c2dc1cf77403031ac7aadcf66","status":"affected","version":"4f128f8e1aaac189f83d0f828bcdb2986d8d2e51","versionType":"git"},{"lessThan":"e5843f4effaa2ffac3e789ecd4456403564961d4","status":"affected","version":"4f128f8e1aaac189f83d0f828bcdb2986d8d2e51","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/arm64/include/asm/kvm_nested.h","arch/arm64/kvm/arm.c","arch/arm64/kvm/nested.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.11"},{"lessThan":"6.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.113","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.56","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.9","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.113","versionStartIncluding":"6.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.56","versionStartIncluding":"6.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.9","versionStartIncluding":"6.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"6.11","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction\n\nWe free the shadow S2 structures from kvm_arch_flush_shadow_all(), which\nis a Bad Idea(tm). Freeing the page tables is fair game (this is what\nthis callback is for), but freeing the container that could still be\nreferenced by another part of the system is not great.\n\nInstead, grow separate destructors that gets called when we tear the VM\ndown for good. From there, we can nuke both the individual MMUs as well\nas the global array that points to them, safe in the knowledge that the\nvcpus themselves have been destroyed already."}],"metrics":[{"cvssV3_1":{"baseScore":7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - Local close() of the last KVM FD reaches kvm_put_kvm() -> kvm_destroy_vm() -> mmu_notifier_unregister() -> kvm_mmu_notifier_release() -> patched kvm_arch_flush_shadow_all(), while concurrent munmap() reaches kvm_unmap_gfn_range() -> kvm_nested_s2_unmap().\nAC:H - Although one process controls both close() and munmap() and stage2_apply_range() drops mmu_lock, reachability requires FEAT_NV2 hardware booted with the explicitly non-default experimental kvm-arm.mode=nested; a low-privileged attacker cannot establish that host state.\nPR:L - The setup uses KVM_CREATE_VM, KVM_CREATE_VCPU, KVM_ARM_VCPU_INIT with KVM_ARM_VCPU_HAS_EL2, and KVM_SET_USER_MEMORY_REGION; none has a capable() check, so an unprivileged local user granted /dev/kvm access suffices.\nUI:N - The attacker creates and runs the nested VM, races munmap() against closing its KVM descriptors, and needs no action from another user.\nS:U - The demonstrated attacker is a host-side /dev/kvm user and the corruption remains in that host kernel; no guest-controlled operation invokes the required close()/munmap() teardown race, so this is local kernel escalation rather than a guest escape.\nC:H - After vulnerable kvm_arch_flush_shadow_all() frees the kvm_s2_mmu block, an in-flight stage2_apply_range() rereads reclaimable mmu->pgt; controlling the replacement kernel object can steer page-table memory accesses and expose arbitrary kernel data.\nI:H - The reclaimed mmu->pgt pointer is passed to kvm_pgtable_stage2_unmap(), whose page-table walker modifies entries through that pointer, giving the kernel-heap use-after-free arbitrary-write and control-flow-hijacking potential.\nA:H - Dereferencing the freed kvm_s2_mmu or a reclaimed mmu->pgt in stage2_apply_range() and kvm_pgtable_stage2_unmap() can produce a host kernel oops or panic."}]}],"providerMetadata":{"dateUpdated":"2026-10-24T14:08:48.611Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/876049f026b4dfaca0cc78ec81be0e639ca8525d"},{"url":"https://git.kernel.org/stable/c/22e82acec93a681071ed36f70eabe2d0c4e0bebd"},{"url":"https://git.kernel.org/stable/c/5bf1c9175e657b3c2dc1cf77403031ac7aadcf66"},{"url":"https://git.kernel.org/stable/c/e5843f4effaa2ffac3e789ecd4456403564961d4"}],"title":"KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98440","datePublished":"2026-10-18T15:14:50.740Z","dateReserved":"2026-09-25T10:25:14.349Z","dateUpdated":"2026-10-24T14:08:48.611Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-18 16:16:54","lastModifiedDate":"2026-10-24 14:16:41","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98440","Ordinal":"1","Title":"KVM: arm64: nv: Delay freeing of shadow S2 structures until VM d","CVE":"CVE-2026-98440","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98440","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction\n\nWe free the shadow S2 structures from kvm_arch_flush_shadow_all(), which\nis a Bad Idea(tm). Freeing the page tables is fair game (this is what\nthis callback is for), but freeing the container that could still be\nreferenced by another part of the system is not great.\n\nInstead, grow separate destructors that gets called when we tear the VM\ndown for good. From there, we can nuke both the individual MMUs as well\nas the global array that points to them, safe in the knowledge that the\nvcpus themselves have been destroyed already.","Type":"Description","Title":"KVM: arm64: nv: Delay freeing of shadow S2 structures until VM d"}]}}}