CVE-2026-98467 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race
Commit 7270cc9157f4 ("KVM: arm64: nv: Handle VNCR_EL2 invalidation from MMU notifiers") introduced VNCR_EL2 invalidation in both kvm_nested_s2_unmap() and kvm_nested_s2_wp().
However at the point of this being performed concurrent stage 2 teardown of a nested guest can cause kvm->arch.mmu.pgt to be set to NULL.
This happens in kvm_flush_shadow_all() -> kvm_arch_flush_shadow_all() -> kvm_free_stage2_pgd() and is performed under the kvm->mmu_lock.
Commit ec14c272408a ("KVM: arm64: nv: Unmap/flush shadow stage 2 page tables") introduced the teardown of the entire nested MMU range, which then invokes stage2_apply_range() with resched=true:
mmu_notifier_invalidate_range_start() -> ... -> kvm_mmu_notifier_invalidate_range_start() -> kvm_mmu_unmap_gfn_range() -> kvm_unmap_gfn_range() -> kvm_nested_s2_unmap() -> kvm_stage2_unmap_range() -> __unmap_stage2_range() -> stage2_apply_range()
This means that stage2_apply_range() can drop the kvm->mmu_lock and thus concurrent progress can be made in lockstep with kvm_arch_flush_shadow_all().
If kvm_arch_flush_shadow_all() advances ahead of stage2_apply_range() and completes its operation it guarantees a NULL pointer deref.
Since kvm_free_stage2_pgd() is performed under the kvm->mmu_lock this will either be observed NULL or not and serialised against kvm_free_stage2_pgd().
Resolve the issue by abstracting the invalidation to a new function, kvm_invalidate_vncr_ipa_all(), and check that the pgt is non-NULL before dereferencing it.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The identified vulnerability in the Linux kernel involves a null pointer dereference within the KVM ARM64 nested virtualization subsystem, specifically affecting operations related to write protection and unmapping of stage 2 page tables. This issue arises from a race condition between memory management unit notifiers handling invalidation requests and the concurrent teardown of the nested guest's memory structures. The root cause is traced back to commit 7270cc9157f4, which introduced VNCR_EL2 invalidation logic into kvm_nested_s2_unmap and kvm_nested_s2_wp functions. While these additions were intended to handle virtual non-coherent cache register invalidations from MMU notifiers, they inadvertently created a window for concurrent execution paths that could lead to accessing freed or uninitialized memory structures.
The technical flaw manifests when the stage 2 teardown process is initiated while an unmap or write-protect operation is in progress. The teardown sequence begins with kvm_flush_shadow_all calling into kvm_arch_flush_shadow_all and subsequently kvm_free_stage2_pgd, all of which are protected by the kvm->mmu_lock. During this cleanup phase, the kernel sets kvm->arch.mmu.pgt to NULL as part of freeing the stage 2 page global directory. However, another concurrent path initiated by commit ec14c272408a involves unmap and flush operations that invoke stage2_apply_range with a reschedule flag set true. This specific configuration allows stage2_apply_range to drop the kvm->mmu_lock temporarily, enabling other threads to proceed concurrently.
If the teardown thread advances ahead of the unmap thread and completes its operation before the latter checks for valid memory structures, it results in a null pointer dereference when attempting to access kvm->arch.mmu.pgt. The race condition exists because stage2_apply_range can yield control back to the scheduler while holding no locks, allowing the teardown process to free resources that are still being accessed by the unmap logic. This scenario highlights a classic synchronization error where lock coverage is insufficient for all code paths involved in shared resource access and deallocation.
From an operational impact perspective, this vulnerability allows for local denial of service attacks within nested virtualization environments. An attacker with sufficient privileges to trigger MMU notifier events or manipulate guest memory mappings could cause the host kernel to crash due to a null pointer dereference. This leads to system instability and potential data loss depending on the criticality of the services running at the time of the fault. The vulnerability is particularly relevant in cloud computing environments where nested virtualization is commonly employed, as it exposes hypervisor stability to guest-controlled actions that trigger memory management notifications.
The resolution involves abstracting the invalidation logic into a dedicated function named kvm_invalidate_vncr_ipa_all and introducing explicit checks to verify that the page table pointer pgt is non-NULL before dereferencing it. This approach ensures that operations are safely serialized against the teardown process, preventing access to freed memory structures. By adding these safeguards, the kernel maintains integrity during concurrent MMU operations without requiring extensive restructuring of existing locking mechanisms.
This vulnerability aligns with CWE-476, which describes a null pointer dereference error where software incorrectly handles an expected non-null value that is actually null. In terms of attack vectors and techniques, this scenario relates to ATT&CK technique T1059 Command and Scripting Interpreter if the crash leads to system instability exploitable for further attacks, though primarily it represents a reliability issue rather than direct privilege escalation. The fix emphasizes robust defensive programming practices by validating pointer states before use in high-concurrency kernel subsystems involving memory management notifications.