SB20261022484 - Expired pointer dereference in Linux kernel x86 kvm

Description

This security bulletin contains information about 1 vulnerability.

1) Expired pointer dereference (CVE-ID: CVE-2026-98863)

CWE-ID: CWE-825 - Expired pointer dereference

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access memory through stale mappings, potentially disclosing or corrupting memory.

The vulnerability exists due to reuse of stale page frame numbers in the Linux kernel's x86 KVM nested virtualization code when resuming a virtual CPU after nested-state page retrieval fails. A local user can re-run a virtual CPU whose vmcs02 retains page frame numbers from a previous L2 run to cause L2 to execute with stale, unpinned memory mappings, potentially disclosing or corrupting memory.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/10180a277549339020b08000206092c07e0bff5a
• https://git.kernel.org/stable/c/525694a6021ec6c8f7ce1f38acdf2dd77698fec1
• https://git.kernel.org/stable/c/942192dbcd3a06695ef6b31cf10a41a21cf014d8