Live › vulnerability › CVE-2026-98470
Go to dashboardOn arm64 Linux hosts running in protected KVM (pKVM) mode, an unrecognized VM ioctl from userspace makes the kernel emit a WARN, which taints the host and panics it when panic_on_warn is set. The result is a denial of service by a local user who can issue ioctls on a VM file descriptor, not code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only arm64 hosts running the Linux KVM with protected mode (pKVM) enabled are exposed, since the WARN path is in the pKVM ioctl check. Hosts without pKVM return -EINVAL for the same ioctl and are not affected by the panic. Teams running ordinary arm64 virtualization or x86 KVM hosts can skip it.
No product ranges from the sources yet.
panic_on_warn at 0 on pKVM hostsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode
kvm_pkvm_ioctl_allowed() WARNs when kvm_get_cap_for_kvm_ioctl() doesn't find the ioctl number in vm_ioctl_caps[], and kvm_arch_vm_ioctl() calls it for every number the generic code doesn't handle, so ioctl(vm_fd, 0xdeadbeef) from userspace taints a pKVM host and panics it under panic_on_warn. The lookup is fed userspace input: return false, and userspace gets the -EINVAL kvm_arch_vm_ioctl() returns for that number on a host without pKVM.
This page as .md · .json · in your agent: get_signal("CVE-2026-98470")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.