---
id: "CVE-2026-98433"
kind: "vulnerability"
aliases: ["CVE-2026-98433"]
title: "Linux KVM on POWER: failed secure page import leaks secure memory"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["kvm", "linux-kernel", "power10", "power9", "powerpc", "runtime", "ultravisor"]
not_affected_if: ["no-ultravisor", "non-powerpc", "x86-host"]
published_at: "2026-10-18T15:16:53+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:27:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98433", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux KVM on POWER: failed secure page import leaks secure memory

When the Ultravisor rejects a page import in the PowerPC KVM code, the kernel never releases the secure device page it already allocated. Each failure permanently consumes one entry from the firmware-bounded secure memory pool and leaves that guest page marked secure for the life of the VM.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98433

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure

In kvmppc_svm_page_in(), if uv_page_in() fails after
kvmppc_uvmem_get_page() has succeeded, the secure device page is never
released.  kvmppc_uvmem_get_page() sets a bit in kvmppc_uvmem_bitmap,
allocates a kvmppc_uvmem_page_pvt struct, marks the GFN as
KVMPPC_GFN_UVMEM_PFN, and calls zone_device_page_init() which sets
refcount=1 and locks the page.  The subsequent goto out_finalize skips
the *mig.dst assignment, so migrate_vma_finalize() is a no-op for the
page, and none of those resources are ever reclaimed.

Each occurrence permanently consumes one entry from the firmware-bounded
secure memory pool (kvmppc_uvmem_bitmap), leaks pvt, and leaves the GFN
marked as secure — making it unusable for the lifetime of the VM.

The twin __kvmppc_svm_page_out() already handles the analogous uv_page_out()
failure correctly with unlock_page(dpage); __free_page(dpage).  Apply
the same pattern here: unlock_page() followed by put_page(), which
chains through free_zone_device_folio() into kvmppc_uvmem_folio_free()
to clear the bitmap bit, free pvt, and reset the GFN state.

Reachable whenever uv_page_in() returns an error (e.g. UV pool
exhaustion) on any POWER9/10 + Ultravisor/PEF system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_