Memory leak in Linux kernel - CVE-2026-98433
Published: October 22, 2026
Vulnerability identifier: #VU156731
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98433
CWE-ID: CWE-401
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service by exhausting secure memory resources.
The vulnerability exists due to a memory leak in the Linux kernel KVM PowerPC Book3S HV kvmppc_svm_page_in() function when uv_page_in() fails after a secure device page has been allocated. A local user can trigger page-in operations that encounter this error to leave secure device pages and associated metadata unreclaimed, potentially exhausting the firmware-bounded secure memory pool and making affected guest frame numbers unusable for the lifetime of the VM.
The issue is reachable on POWER9/10 systems using Ultravisor/PEF.
Affected software
Linux kernel
How to mitigate CVE-2026-98433
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/0a416ee20bcccddf91ca5b63696a23b9d11d73aa
- https://git.kernel.org/stable/c/8f3b7746874b39fc20e0363c9076c7787d4765ba
- https://git.kernel.org/stable/c/a933d7024359e2e566b07903d1294b84f90482ae
- https://git.kernel.org/stable/c/c41088b2765af1e97e7bb05f906ae1823eca0388
- https://git.kernel.org/stable/c/dfb84274932737e338ff5eb27f34b4c8ecb01b50
- https://git.kernel.org/stable/c/ed2f2ff63cb7e71204096e765c6d02c3b6974b95
- https://git.kernel.org/stable/c/f3d4b2fc30c97cf8e6f8b880d2de9c17ecac7f5b
- https://git.kernel.org/stable/c/fcbff8008b0e08cd53b611bd0ff7e01f5b962f80