{"id":"CVE-2026-98469","kind":"vulnerability","aliases":["CVE-2026-98469"],"related":[],"title":"Linux KVM: AArch32 guest breakpoint access kills the virtual machine","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Fix AArch32 DBGBXVR<n> handling\n\nThe consolidation of the breakpoint and watchpoint register accessors\nswitched DBGBXVR<n> from trap_bvr() to trap_dbg_wb_reg(). The latter\nselects backing storage with demux_wb_reg(), which only handles Op2 values\n4 through 7. Since DBGBXVR<n> uses Op2 1, an AArch32 guest access hits\nKVM_BUG_ON() and marks the VM dead.\n\nDBGBXVR<n> aliases DBGBVR<n>_EL1[63:32], and its AA32(HI) descriptor\nalready selects the upper half. Map Op2 1 to dbg_bvr[] alongside Op2 4,\nrestoring the pre-regression behavior.","summary":"The Linux kernel's arm64 KVM code mishandles AArch32 guest accesses to the DBGBXVR breakpoint registers after a refactor. The access triggers a kernel BUG and marks the virtual machine dead.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm64","infrastructure","kvm","linux"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:16:57+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:26:02+00:00","updated_at":"2026-10-25T05:26:02+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:26:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux KVM: AArch32 guest breakpoint access kills the virtual machine","impact":"low","summary":"The Linux kernel's arm64 KVM code mishandles AArch32 guest accesses to the DBGBXVR breakpoint registers after a refactor. The access triggers a kernel BUG and marks the virtual machine dead.","category":"infrastructure","nicknames":[],"who_cares":["linux","kvm","arm64"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Guest triggers kernel BUG, killing the VM; host impact unclear","analyst_note":"Check the upstream kernel commit and NVD entry CVE-2026-98469 for affected and fixed kernel versions and whether a host crash or only VM denial of service results.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Hosts running Linux KVM on arm64 that run 32-bit AArch32 guests with debug register use are the likely exposure; the sources do not name affected kernel versions. unknown whether guests can trigger this without special setup.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000571,"input_tokens":3518,"output_tokens":439,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98469':13A,16A '1':108C,140C '32':127C '4':101C,146C '63':126C '7':103C 'aa32':130C 'aarch32':3A,29B,65C,110C 'access':6A,31B,41B,112C 'accessor':76C 'alias':123C 'alongsid':144C 'alreadi':133C 'arm64':17B,25B,63C 'back':90C 'behavior':152C 'breakpoint':5A,35B,72C 'bug':45B,115C 'bvr':81C,143C 'code':27B 'consolid':69C 'cve':11A,14A 'dbg':84C,142C 'dbgbvr':124C 'dbgbxvr':34B,66C,78C,105C,122C 'dead':51B,121C 'demux':93C 'descriptor':132C 'el1':125C 'fix':64C 'follow':57C 'guest':4A,30B,111C 'half':137C 'handl':67C,98C 'hi':131C 'hit':113C 'infrastructur':18B 'kernel':23B,44B,55C 'kill':7A 'kvm':2A,19B,26B,62C,114C 'latter':88C 'linux':1A,20B,22B,54C 'machin':10A,50B 'map':138C 'mark':47B,118C 'mishandl':28B 'op2':99C,107C,139C,145C 'pre':150C 'pre-regress':149C 'refactor':39B 'reg':86C,95C 'regist':36B,75C 'regress':151C 'resolv':61C 'restor':147C 'select':89C,134C 'sinc':104C 'storag':91C 'switch':77C 'trap':80C,83C 'trigger':42B 'upper':136C 'use':106C 'valu':100C 'virtual':9A,49B 'vm':120C 'vulner':58C 'watchpoint':74C 'wb':85C,94C","nicknames":[],"mitigations":[],"who_affected":"Hosts running Linux KVM on arm64 that run 32-bit AArch32 guests with debug register use are the likely exposure; the sources do not name affected kernel versions. unknown whether guests can trigger this without special setup.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98469","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98469","severity":null,"published_at":"2026-10-18T16:16:57+00:00","modified_at":"2026-10-19T10:18:57+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}