Live › vulnerability › CVE-2026-98440
Go to dashboardIn the Linux kernel's arm64 KVM nested-virtualization code, shadow stage-2 structures were freed during a flush callback while other parts of the system could still reference them. The fix delays freeing them until the VM is destroyed, and the description does not state a confirmed attacker outcome.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction
We free the shadow S2 structures from kvm_arch_flush_shadow_all(), which is a Bad Idea(tm). Freeing the page tables is fair game (this is what this callback is for), but freeing the container that could still be referenced by another part of the system is not great.
Instead, grow separate destructors that gets called when we tear the VM down for good. From there, we can nuke both the individual MMUs as well as the global array that points to them, safe in the knowledge that the vcpus themselves have been destroyed already.
This page as .md · .json · in your agent: get_signal("CVE-2026-98440")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.