{"id":"CVE-2026-98717","kind":"vulnerability","aliases":["CVE-2026-98717"],"related":[],"title":"Linux KVM: race during memslot creation causes kernel NULL pointer dereference crash","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy\n\nWhen walking shadow page tables, immediately terminate the walk if the root\nis a \"dummy\" root, i.e. a root whose top-level page table is backed by the\nzero page, but otherwise doesn't exist.  If memslot creation races with a\nstage-2 page fault (EPT violation or #NPF) from L2, then if the stars align,\nKVM will attempt to walk shadow page tables using the zero page and hit a\nNULL pointer deref.\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000021\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 0 P4D 0\n  Oops: Oops: 0000 [#1] SMP\n  CPU: 30 UID: 1000 PID: 941 Comm: qemu Not tainted 7.2.0-rc2-1b731e5ded48-next-vm #1741 PREEMPTLAZY\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  RIP: 0010:__kvm_mmu_invalidate_addr+0xea/0x210 [kvm]\n  Call Trace:\n   <TASK>\n   kvm_mmu_invalidate_addr+0x92/0xe0 [kvm]\n   __kvm_inject_emulated_page_fault+0x67/0x80 [kvm]\n   ept_page_fault+0x160/0x850 [kvm]\n   kvm_mmu_do_page_fault+0x102/0x1f0 [kvm]\n   kvm_mmu_page_fault+0x8e/0x6b0 [kvm]\n   vmx_handle_exit+0x163/0x640 [kvm_intel]\n   kvm_arch_vcpu_ioctl_run+0x960/0x2120 [kvm]\n   kvm_vcpu_ioctl+0x2c7/0x970 [kvm]\n   __x64_sys_ioctl+0x90/0xd0\n   do_syscall_64+0x67/0x5f0\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x7f606d0b53bb\n\nOpportunistically harden the shadow walks against fully invalid roots, but\nWARN, as all callers are expected/required to pre-check for a valid root.\nDon't WARN in the dummy root case as the whole point of using a dummy root\nis to provide a root that's valid enough to enter the guest, i.e. it should\nJust Work for all flows except those that *need* to know about dummy roots.\n\nAlternatively, KVM could allocate a dedicated page and associated shadow\npage structure for the dummy root, which is very tempting as it such an\napproach should be more resilient against unexpected behavior.  But that\nwould be a much larger and thus riskier change than simply terminating\nwalks of dummy roots.","summary":"A race between memslot creation and a nested guest stage-2 page fault can make KVM walk shadow page tables backed by the zero page, causing a kernel NULL pointer dereference. The sources describe a kernel oops (crash) on x86 KVM hosts; they do not describe code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kvm","linux","runtime","self-hosted","virtualization","x86"],"not_affected_if":["no-kvm","no-nested-virtualization","non-x86"],"how_to_check":"- `uname -r` and compare against the fixed kernel version, which the sources do not name\n- Check whether KVM is in use with `lsmod | grep kvm` and whether nested virtualization is enabled, for example `cat /sys/module/kvm_intel/parameters/nested` or `cat /sys/module/kvm_amd/parameters/nested`","fix":"- Update the Linux kernel to a release that includes the upstream fix for CVE-2026-98717; the fixed version is unknown from the sources\n- Reboot the host after updating so the fixed kernel is running","status":"open","published_at":"2026-10-18T16:17:25+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:17:28+00:00","updated_at":"2026-10-25T05:17:28+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:17:28Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for CVE-2026-98717; the fixed version is unknown from the sources\n- Reboot the host after updating so the fixed kernel is running","reach":"local","title":"Linux KVM: race during memslot creation causes kernel NULL pointer dereference crash","impact":"low","summary":"A race between memslot creation and a nested guest stage-2 page fault can make KVM walk shadow page tables backed by the zero page, causing a kernel NULL pointer dereference. The sources describe a kernel oops (crash) on x86 KVM hosts; they do not describe code execution.","category":"runtime","nicknames":[],"who_cares":["linux","kvm","x86","self-hosted","virtualization"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Host kernel crashes with an oops, causing a denial of service","analyst_note":"Find the fixed kernel version and the upstream commit in the kernel stable tree or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-98717.","how_to_check":"- `uname -r` and compare against the fixed kernel version, which the sources do not name\n- Check whether KVM is in use with `lsmod | grep kvm` and whether nested virtualization is enabled, for example `cat /sys/module/kvm_intel/parameters/nested` or `cat /sys/module/kvm_amd/parameters/nested`","needs_analyst":true,"not_affected_if":["no-kvm","non-x86","no-nested-virtualization"],"who_is_affected":"Hosts running Linux with KVM on x86 that run nested guests (a hypervisor inside a VM) are affected, since the bug needs a stage-2 page fault from a nested guest racing with memslot creation. Hosts without KVM, non-x86 systems, and hosts without nested virtualization are unlikely to be exposed, though the sources do not state this explicitly.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000782,"input_tokens":4254,"output_tokens":714,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':240C,249C,257C,263C,271C,278C,284C,293C,299C,305C,310C,317C '-2':37B,142C '-2026':14A,17A '-98717':15A,18A '0':197C,199C '0.0.0':232C '0000':202C '0000000000000021':180C '0010':235C '0033':320C '02/06/2015':233C '0x0000':191C '0x7f606d0b53bb':321C '1':203C '1000':208C '1741':221C '1b731e5ded48':218C '2009':230C '30':206C '64':309C,314C '7.2.0':215C '941':210C 'access':184C 'addr':239C,248C 'address':179C 'align':155C 'alloc':396C 'altern':393C 'approach':417C 'arch':289C 'associ':401C 'attempt':158C 'back':47B,125C 'bail':87C 'behavior':424C 'bio':231C 'bug':174C 'call':243C 'caller':335C 'case':353C 'caus':7A,52B 'chang':435C 'check':341C 'code':73B,190C 'comm':211C 'could':395C 'cpu':205C 'crash':12A,64B 'creation':6A,31B,137C 'cve':13A,16A 'dedic':398C 'deref':173C 'derefer':11A,57B,178C 'describ':60B,72B 'doesn':132C 'dummi':98C,113C,351C,361C,391C,407C,441C 'emul':254C 'enough':371C 'enter':373C 'entri':312C 'ept':145C,260C 'error':189C 'except':384C 'execut':74B 'exist':134C 'exit':283C 'expected/required':337C 'fault':39B,144C,256C,262C,270C,277C 'flow':383C 'follow':80C 'fulli':328C 'guest':35B,375C 'handl':282C 'harden':323C 'hardwar':223C 'hit':169C 'host':24B,68B 'hwframe':316C 'i.e':115C,376C 'ich9':229C 'immedi':104C 'inject':253C 'intel':287C 'invalid':95C,238C,247C,329C 'ioctl':291C,298C,304C 'kernel':8A,54B,62B,78C,175C,186C 'know':389C 'kvm':2A,19B,42B,67B,85C,156C,236C,242C,245C,251C,252C,259C,265C,266C,273C,274C,280C,286C,288C,295C,296C,301C,394C 'l2':150C 'larger':431C 'level':121C 'linux':1A,20B,77C 'make':41B 'memslot':5A,30B,136C 'mmu':237C,246C,267C,275C 'mode':187C 'much':430C 'name':224C 'need':387C 'nest':34B 'next':219C 'not-pres':192C 'npf':148C 'null':9A,55B,171C,176C 'oop':63B,200C,201C 'opportunist':322C 'otherwis':131C 'p4d':198C 'page':38B,45B,51B,102C,122C,129C,143C,162C,167C,195C,255C,261C,269C,276C,399C,403C 'pc':227C 'pf':181C,188C 'pgd':196C 'pid':209C 'point':357C 'pointer':10A,56B,172C,177C 'pre':340C 'pre-check':339C 'preemptlazi':222C 'present':194C 'provid':365C 'q35':228C 'qemu':212C,225C 'race':3A,28B,138C 'rc2':217C 'rc2-1b731e5ded48-next-vm':216C 'read':183C 'resili':421C 'resolv':84C 'rip':234C,319C 'riskier':434C 'root':93C,110C,114C,117C,330C,345C,352C,362C,367C,392C,408C,442C 'run':292C 'runtim':21B 'self':23B 'self-host':22B 'shadow':44B,89C,101C,161C,325C,402C 'simpli':437C 'smp':204C 'sourc':59B 'stage':36B,141C 'standard':226C 'star':154C 'structur':404C 'supervisor':182C 'sys':303C 'syscal':308C,313C 'tabl':46B,103C,123C,163C 'taint':214C 'tempt':412C 'termin':105C,438C 'thus':433C 'top':120C 'top-level':119C 'trace':244C 'uid':207C 'unexpect':423C 'use':164C,359C 'valid':344C,370C 'vcpu':290C,297C 'violat':146C 'virtual':25B 'vm':220C 'vmx':281C 'vulner':81C 'walk':43B,90C,100C,107C,160C,326C,439C 'warn':332C,348C 'whole':356C 'whose':118C 'work':380C 'would':427C 'x102/0x1f0':272C 'x160/0x850':264C 'x163/0x640':285C 'x2c7/0x970':300C 'x4b/0x53':318C 'x64':302C 'x67/0x5f0':311C 'x67/0x80':258C 'x86':26B,66B 'x86/mmu':86C 'x8e/0x6b0':279C 'x90/0xd0':306C 'x92/0xe0':250C 'x960/0x2120':294C 'xea/0x210':241C 'zero':50B,128C,166C","nicknames":[],"mitigations":[],"who_affected":"Hosts running Linux with KVM on x86 that run nested guests (a hypervisor inside a VM) are affected, since the bug needs a stage-2 page fault from a nested guest racing with memslot creation. Hosts without KVM, non-x86 systems, and hosts without nested virtualization are unlikely to be exposed, though the sources do not state this explicitly.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98717","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98717","severity":null,"published_at":"2026-10-18T16:17:25+00:00","modified_at":"2026-10-21T13:21:39+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}