{"id":"CVE-2026-98638","kind":"vulnerability","aliases":["CVE-2026-98638"],"related":[],"title":"Linux kernel KVM arm64: invalid SVE vector length can crash the hypervisor","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()\n\npkvm_vcpu_init_sve() clamps only the upper bound of the host-provided\nsve_max_vl, so an invalid vector length reaches sve_state_size_from_vl()\nand the WARN_ON() there, which is fatal at EL2. The existing\n!sve_state_size test rejects such a length, but only after the macro has\nrun.\n\nCheck sve_vl_valid() before deriving the state size. A valid length\ncannot yield a zero size, so the !sve_state_size test goes with it.","summary":"In the Linux kernel's arm64 KVM, pkvm_vcpu_init_sve() checks only the upper bound of the host-provided SVE vector length, so an invalid length reaches a WARN_ON() that is fatal at EL2. The sources do not state what an attacker can do beyond triggering that failure.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm64","infrastructure","kvm","linux-kernel","pkvm"],"not_affected_if":["non-arm64-hardware","pkvm-not-enabled"],"how_to_check":"- unknown","fix":"- Apply the kernel fix that validates the SVE vector length with sve_vl_valid() before deriving the state size in pkvm_vcpu_init_sve(); the sources do not name fixed kernel versions.","status":"open","published_at":"2026-10-18T16:17:16+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:20:57+00:00","updated_at":"2026-10-25T05:20:57+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:20:57Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the kernel fix that validates the SVE vector length with sve_vl_valid() before deriving the state size in pkvm_vcpu_init_sve(); the sources do not name fixed kernel versions.","reach":"local","title":"Linux kernel KVM arm64: invalid SVE vector length can crash the hypervisor","impact":"medium","summary":"In the Linux kernel's arm64 KVM, pkvm_vcpu_init_sve() checks only the upper bound of the host-provided SVE vector length, so an invalid length reaches a WARN_ON() that is fatal at EL2. The sources do not state what an attacker can do beyond triggering that failure.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","arm64","kvm","pkvm"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Confirm affected kernel versions, fixed commit, and whether a guest or only the host can trigger the invalid vector length, using the NVD entry for CVE-2026-98638.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["non-arm64-hardware","pkvm-not-enabled"],"who_is_affected":"Systems running Linux kernels on arm64 hosts that use KVM in protected mode (pKVM) with SVE-capable vCPUs are the ones this code path affects. The sources do not say which kernel versions are vulnerable or whether default configurations enable pKVM.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000624,"input_tokens":3435,"output_tokens":560,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98638':15A,18A 'arm64':4A,19B,31B,88C 'attack':70B 'beyond':73B 'bound':41B,107C 'cannot':166C 'check':37B,154C 'clamp':103C 'crash':10A 'cve':13A,16A 'deriv':159C 'el2':62B,136C 'exist':138C 'failur':76B 'fatal':60B,134C 'follow':82C 'goe':177C 'host':45B,111C 'host-provid':44B,110C 'hypervisor':12A 'infrastructur':20B 'init':35B,97C,101C 'invalid':5A,52B,118C 'kernel':2A,24B,29B,80C 'kvm':3A,21B,32B,87C 'length':8A,49B,53B,93C,120C,146C,165C 'linux':1A,23B,28B,79C 'linux-kernel':22B 'macro':151C 'max':114C 'pkvm':25B,33B,95C,99C 'provid':46B,112C 'reach':54B,121C 'reject':143C 'resolv':86C 'run':153C 'size':124C,141C,162C,170C,175C 'sourc':64B 'state':67B,123C,140C,161C,174C 'sve':6A,36B,47B,91C,98C,102C,113C,122C,139C,155C,173C 'test':142C,176C 'trigger':74B 'upper':40B,106C 'valid':89C,157C,164C 'vcpu':34B,96C,100C 'vector':7A,48B,92C,119C 'vl':115C,126C,156C 'vulner':83C 'warn':56B,129C 'yield':167C 'zero':169C","nicknames":[],"mitigations":[],"who_affected":"Systems running Linux kernels on arm64 hosts that use KVM in protected mode (pKVM) with SVE-capable vCPUs are the ones this code path affects. The sources do not say which kernel versions are vulnerable or whether default configurations enable pKVM.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98638","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98638","severity":null,"published_at":"2026-10-18T16:17:16+00:00","modified_at":"2026-10-19T10:19:28+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}