CVE-2026-98717 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy
When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero page, but otherwise doesn't exist. If memslot creation races with a stage-2 page fault (EPT violation or #NPF) from L2, then if the stars align, KVM will attempt to walk shadow page tables using the zero page and hit a NULL pointer deref.
BUG: kernel NULL pointer dereference, address: 0000000000000021 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP
CPU: 30 UID: 1000 PID: 941 Comm: qemu Not tainted 7.2.0-rc2-1b731e5ded48-next-vm #1741 PREEMPTLAZY Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:__kvm_mmu_invalidate_addr+0xea/0x210 [kvm]
Call Trace: <TASK> kvm_mmu_invalidate_addr+0x92/0xe0 [kvm]
__kvm_inject_emulated_page_fault+0x67/0x80 [kvm]
ept_page_fault+0x160/0x850 [kvm]
kvm_mmu_do_page_fault+0x102/0x1f0 [kvm]
kvm_mmu_page_fault+0x8e/0x6b0 [kvm]
vmx_handle_exit+0x163/0x640 [kvm_intel]
kvm_arch_vcpu_ioctl_run+0x960/0x2120 [kvm]
kvm_vcpu_ioctl+0x2c7/0x970 [kvm]
__x64_sys_ioctl+0x90/0xd0 do_syscall_64+0x67/0x5f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f606d0b53bb
Opportunistically harden the shadow walks against fully invalid roots, but WARN, as all callers are expected/required to pre-check for a valid root. Don't WARN in the dummy root case as the whole point of using a dummy root is to provide a root that's valid enough to enter the guest, i.e. it should Just Work for all flows except those that *need* to know about dummy roots.
Alternatively, KVM could allocate a dedicated page and associated shadow page structure for the dummy root, which is very tempting as it such an approach should be more resilient against unexpected behavior. But that would be a much larger and thus riskier change than simply terminating walks of dummy roots.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in the Linux kernel's KVM subsystem represents a critical race condition within the x86 memory management unit, specifically affecting how shadow page tables are traversed during virtualization operations. The core technical flaw lies in the handling of invalid or non-existent root pointers when processing stage-2 page faults originating from nested guests. When a guest operating system attempts to access memory that triggers an Extended Page Table (EPT) violation or a Nested Page Fault, KVM must resolve these addresses by walking through shadow page tables. However, under specific timing conditions where the creation of a new memory slot races with this fault handling process, the kernel may attempt to use a root pointer that is effectively nullified because it points only to the zero page rather than an actual allocated structure. This state is referred to as a dummy root, which serves as a placeholder to allow guest entry but lacks the full structural integrity required for deep shadow walks.
The operational impact of this flaw manifests as a kernel NULL pointer dereference, leading to a system crash or denial of service. The provided stack trace indicates that the fault occurs within the __kvm_mmu_invalidate_addr function, which is invoked during the emulation of page faults via ept_page_fault and kvm_arch_vcpu_ioctl_run paths. Because this code executes in supervisor mode with high privileges, an attacker who can trigger these race conditions from a guest environment may cause the host kernel to crash. This constitutes a significant availability risk for virtualized environments, particularly those running nested virtualization workloads where L2 guests interact directly with KVM's memory management infrastructure without proper synchronization checks against concurrent memslot modifications.
From a vulnerability classification perspective, this issue aligns closely with CWE-476, which denotes NULL Pointer Dereference, as the immediate cause of failure is accessing memory at address zero due to an unvalidated pointer assumption. Furthermore, it relates to CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization Race Condition, because the root cause is a race between memslot creation and page fault handling that leaves the system in an inconsistent state regarding root validity. In terms of attack vectors, this vulnerability can be leveraged for Denial of Service attacks against virtualization hosts, fitting into ATT&CK techniques related to resource hijacking or disruption of host services through guest-side actions.
The mitigation implemented involves modifying the shadow walk logic to explicitly check for dummy roots and terminate the traversal immediately if such a root is detected, rather than proceeding with an invalid structure. This approach avoids allocating dedicated pages for every dummy root, which would introduce higher complexity and potential new failure modes. By halting the walk early, KVM prevents the NULL pointer dereference while maintaining performance efficiency. Administrators should ensure that their virtualization hosts are updated to include this kernel patch, as it addresses a fundamental assumption in the MMU code that previously relied on callers pre-checking for valid roots without sufficient defensive programming against race-induced invalid states. Regular updates to the KVM subsystem and careful monitoring of nested guest configurations can further reduce exposure to such timing-based vulnerabilities.