---
id: "CVE-2026-98863"
kind: "vulnerability"
aliases: ["CVE-2026-98863"]
title: "Linux kernel KVM: failed nested page mapping can leave stale guest memory mapped"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["hypervisor-hosts", "kvm", "linux-kernel", "runtime", "x86"]
not_affected_if: ["nested-virtualization-disabled", "no-kvm"]
published_at: "2026-10-18T16:17:40+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T05:12:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98863", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Linux kernel KVM: failed nested page mapping can leave stale guest memory mapped

When KVM fails to map a nested guest's pages before returning to userspace, the request to retry is not re-queued, so a rerun of the vCPU can re-enter the guest with stale, unpinned host page frames mapped into its virtual APIC page. The sources do not describe a confirmed exploit path or attacker capability beyond this memory-safety consequence.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and compare against the fixed kernel versions in the upstream commit referenced by the NVD entry
- Check whether KVM nested virtualization is in use with `cat /sys/module/kvm_intel/parameters/nested` or `cat /sys/module/kvm_amd/parameters/nested`
- unknown for other checks: the sources do not list affected version ranges

## Fix

- Update the Linux kernel to a release that includes the upstream fix (the commit re-pends KVM_REQ_GET_NESTED_STATE_PAGES on failure); exact fixed versions: unknown
- Distribution kernel advisories: unknown

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98863

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails

Re-pend GET_NESTED_STATE_PAGES before exiting to userspace if getting the
nested pages fails in the KVM_RUN path.  If userspace re-runs the vCPU, and
vmcs02 holds valid PFNs from the *previous* run of L2, then KVM could
re-enter L2 with stale, unpinned PFNs mapped into e.g. the vAPIC page.

Note, both SVM and VMX (as of commit 11722439fb20 ("KVM: nVMX: Ensure
KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit") ensure the request
is cleared on VM-Exit (including the "forced" case), i.e. there is no risk
of double-mapping due to emulated VMLAUNCH/VMRESUME/VMRUN *and* the request
trying to map the nested pages.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_