{"id":"CVE-2026-98713","kind":"vulnerability","aliases":["CVE-2026-98713"],"related":[],"title":"Linux KVM arm64: fine-grained UNDEF traps applied without FEAT_FGT hardware","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT\n\nFGUs don't actually require hardware support, so don't gate fgt trap\nconfig insertion on FGT. This is the only action required to allow FGUs\nalways, as kvm_calculate_traps() already computes the FGU bits with or\nwithout FEAT_FGT.\n\nThis also fixes a spurious WARN when a TLBI OS is run on a guest in vEL1\nwithout FEAT_TLBIOS on non FEAT_FGT hardware. In this configuration the\ncourse-grained HCR_EL2.TTLBOS trap reaches the handler handle_tlbi_el1(),\nwhich expects an EL1 TLBI only from vEL2. With FGUs enabled the UNDEF\nwill be injected without needing the specific handler.\n\n[oliver: Take Wei-Lin's suggested changelog]","summary":"The Linux kernel's arm64 KVM hypervisor now injects fine-grained UNDEF traps even on hardware without FEAT_FGT, fixing a spurious kernel WARN when a guest runs a TLBI OS operation. The sources describe a correctness fix and do not state an attacker-controlled impact.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm64","infrastructure","kvm","linux-kernel","self-hosted"],"not_affected_if":["no-kvm","x86-hosts"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream KVM arm64 fine-grained UNDEF commit, as listed in the NVD entry for CVE-2026-98713.","status":"open","published_at":"2026-10-18T16:17:24+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:17:31+00:00","updated_at":"2026-10-25T05:17:31+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:17:31Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream KVM arm64 fine-grained UNDEF commit, as listed in the NVD entry for CVE-2026-98713.","reach":"local","title":"Linux KVM arm64: fine-grained UNDEF traps applied without FEAT_FGT hardware","impact":"low","summary":"The Linux kernel's arm64 KVM hypervisor now injects fine-grained UNDEF traps even on hardware without FEAT_FGT, fixing a spurious kernel WARN when a guest runs a TLBI OS operation. The sources describe a correctness fix and do not state an attacker-controlled impact.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","kvm","arm64","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the NVD entry and the upstream kernel commit to confirm whether the fix only removes a spurious WARN or addresses a wider security impact on arm64 KVM hosts.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["x86-hosts","no-kvm"],"who_is_affected":"Hosts running the Linux kernel with KVM on arm64 hardware that hosts guests at vEL1 without FEAT_FGT, where a guest may issue TLBI OS operations. Systems on x86 or without KVM virtualization are not affected by this change. The sources do not say whether any exploitable condition exists beyond the spurious WARN.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000642,"input_tokens":3533,"output_tokens":578,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98713':16A,19A 'action':119C 'actual':101C 'allow':122C 'alreadi':129C 'also':140C 'alway':124C 'appli':9A,89C 'arm64':3A,20B,33B,88C 'attack':74B 'attacker-control':73B 'bit':133C 'calcul':127C 'changelog':207C 'comput':130C 'config':111C 'configur':166C 'control':75B 'correct':66B 'cours':169C 'course-grain':168C 'cve':14A,17A 'describ':64B 'el1':178C,182C 'enabl':189C 'even':43B 'expect':180C 'feat':11A,47B,96C,137C,157C,161C 'fgt':12A,48B,97C,109C,114C,138C,162C 'fgu':132C 'fgus':98C,123C,188C 'fine':5A,39B,92C 'fine-grain':4A,38B,91C 'fix':49B,67B,141C 'follow':82C 'gate':108C 'grain':6A,40B,93C,170C 'guest':56B,153C 'handl':176C 'handler':175C,199C 'hardwar':13A,45B,103C,163C 'hcr_el2.ttlbos':171C 'host':28B 'hypervisor':35B 'impact':76B 'infrastructur':21B 'inject':37B,194C 'insert':112C 'kernel':25B,31B,52B,80C 'kvm':2A,22B,34B,87C,126C 'lin':204C 'linux':1A,24B,30B,79C 'linux-kernel':23B 'need':196C 'non':160C 'oliv':200C 'oper':61B 'os':60B,148C 'reach':173C 'requir':102C,120C 'resolv':86C 'run':57B,150C 'self':27B 'self-host':26B 'sourc':63B 'specif':198C 'spurious':51B,143C 'state':71B 'suggest':206C 'support':104C 'take':201C 'tlbi':59B,147C,177C,183C 'tlbio':158C 'trap':8A,42B,110C,128C,172C 'undef':7A,41B,94C,191C 'vel1':155C 'vel2':186C 'vulner':83C 'warn':53B,144C 'wei':203C 'wei-lin':202C 'without':10A,46B,95C,136C,156C,195C","nicknames":[],"mitigations":[],"who_affected":"Hosts running the Linux kernel with KVM on arm64 hardware that hosts guests at vEL1 without FEAT_FGT, where a guest may issue TLBI OS operations. Systems on x86 or without KVM virtualization are not affected by this change. The sources do not say whether any exploitable condition exists beyond the spurious WARN.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98713","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98713","severity":null,"published_at":"2026-10-18T16:17:24+00:00","modified_at":"2026-10-19T10:19:35+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}