Live › vulnerability › CVE-2026-98638
Go to dashboardIn the Linux kernel's arm64 KVM, pkvm_vcpu_init_sve() checks only the upper bound of the host-provided SVE vector length, so an invalid length reaches a WARN_ON() that is fatal at EL2. The sources do not state what an attacker can do beyond triggering that failure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running Linux kernels on arm64 hosts that use KVM in protected mode (pKVM) with SVE-capable vCPUs are the ones this code path affects. The sources do not say which kernel versions are vulnerable or whether default configurations enable pKVM.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()
pkvm_vcpu_init_sve() clamps only the upper bound of the host-provided sve_max_vl, so an invalid vector length reaches sve_state_size_from_vl() and the WARN_ON() there, which is fatal at EL2. The existing !sve_state_size test rejects such a length, but only after the macro has run.
Check sve_vl_valid() before deriving the state size. A valid length cannot yield a zero size, so the !sve_state_size test goes with it.
This page as .md · .json · in your agent: get_signal("CVE-2026-98638")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.