SB20261022318 - Always-Incorrect Control Flow Implementation in Linux kernel arm64 kvm

Description

This security bulletin contains information about 1 vulnerability.

1) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-98713)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger a spurious kernel warning through incorrectly handled guest instructions in arm64 KVM.

The vulnerability exists due to incorrect conditional gating of fine-grained undefined-instruction trap configuration in arm64 KVM when initializing nested virtualization traps on hardware without FEAT_FGT. A local privileged user can execute a TLBI OS instruction at guest vEL1 without FEAT_TLBIOS to reach handle_tlbi_el1(), which expects an EL1 TLBI only from vEL2, and trigger a kernel warning instead of the intended undefined-instruction exception.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1113374a17d7f7d16b02ee0bbd9b1e7a60cbb087
• https://git.kernel.org/stable/c/2f4a15c52a552c5244ec27f4ca8bda855594f918
• https://git.kernel.org/stable/c/4bdd2b3a708c1feb701cb8b62feb8ad2fd77bb07
• https://git.kernel.org/stable/c/af3300b3a6bace925a496f3520e171c07b999c72