Improper access control in Linux kernel - CVE-2026-98466

Vulnerability identifier: #VU156764

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98466

CWE-ID: CWE-284

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local privileged user to potentially access hypervisor stack memory from the host, compromising isolation between the host and hypervisor.

The vulnerability exists due to incomplete memory ownership enforcement in the arm64 KVM fix_host_ownership() function when establishing host stage-2 memory ownership. A local privileged user can potentially access hypervisor stack pages that remain accessible through the host stage-2 mappings because the ownership walk covers only linear-map aliases and omits the per-CPU hypervisor stacks in the private virtual address range.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/22df195bff84300a3f04813d6148765c77ac565a
• https://git.kernel.org/stable/c/3a8c562892b96f35bba1e00d5e455a15963bbb92
• https://git.kernel.org/stable/c/e5dd2a91a7ae3a276e6d79806127e923936e241b

• Improper access control in Linux kernel hyp nvhe
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more