SB2026102236 - Improper access control in Linux kernel hyp nvhe

Description

This security bulletin contains information about 1 vulnerability.

1) Improper access control (CVE-ID: CVE-2026-98466)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially access hypervisor stack memory from the host, compromising isolation between the host and hypervisor.

The vulnerability exists due to incomplete memory ownership enforcement in the arm64 KVM fix_host_ownership() function when establishing host stage-2 memory ownership. A local privileged user can potentially access hypervisor stack pages that remain accessible through the host stage-2 mappings because the ownership walk covers only linear-map aliases and omits the per-CPU hypervisor stacks in the private virtual address range.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/22df195bff84300a3f04813d6148765c77ac565a
• https://git.kernel.org/stable/c/3a8c562892b96f35bba1e00d5e455a15963bbb92
• https://git.kernel.org/stable/c/e5dd2a91a7ae3a276e6d79806127e923936e241b