Use-after-free in Linux kernel - CVE-2026-98283

Vulnerability details

The vulnerability allows a local user to trigger access to freed kernel memory.

The vulnerability exists due to use-after-free in kvmhv_emulate_tlbie_all_lpid() when iterating nested-guest entries and dropping mmu_lock without holding a reference to the nested-guest object. A local user can issue a concurrent single-LPID tlbie operation from another vCPU to trigger access to freed kernel memory.

The memory-release path is fully controlled by the L1 guest. The single-LPID operation uses is=2 and ric=2.

Affected software

How to mitigate CVE-2026-98283

External References

• https://git.kernel.org/stable/c/24b634852413229bb8340d908b115c3365f3a247
• https://git.kernel.org/stable/c/4d8f7b1f586375df8bce23a0909566ad5e852259
• https://git.kernel.org/stable/c/51938dfa8a51a4f85328413fca9b6e21f9d2d088
• https://git.kernel.org/stable/c/e37fba1ba69385cff2d0e60b371ee19e7d1852d1
• https://git.kernel.org/stable/c/ec2d7a52b3996ae81131617b4afc0af31583c1b4
• https://git.kernel.org/stable/c/fbf69b7d0555ee83c871f58750770f74b7179ad1

Related Security Bulletins

• Use-after-free in Linux kernel powerpc kvm
• Debian update for linux