CVE-2026-98468

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix spurious warning for benign stage 2 teardown race kvmtool was used to establish an L1 guest with 8 CPUs and 8 GiB of RAM, an L2 guest with 4 CPUs and 4 GiB of RAM and an L3 guest with 2 CPUs and 2 GiB of RAM, all of which was then exited. Under memory pressure in the L0 host warnings were observed due to migration triggered by compaction: WARNING: arch/arm64/kvm/mmu.c:336 at __unmap_stage2_range+0x64/0x80, CPU#5: kcompactd0/66 Which was, in turn, triggered by an MMU notifier for the host invalidation: mmu_notifier_invalidate_range_start() -> ... -> kvm_mmu_notifier_invalidate_range_start() -> kvm_mmu_unmap_gfn_range() -> kvm_unmap_gfn_range() -> kvm_nested_s2_unmap() -> kvm_stage2_unmap_range() -> __unmap_stage2_range() -> stage2_apply_range() <- -EINVAL, triggering a WARN_ON() Racing with L0's teardown of stage 2 page tables: exit_mm() -> mmput() -> __mmput() -> exit_mmap() -> mmu_notifier_release() -> ... -> kvm_mmu_notifier_release() -> kvm_flush_shadow_all() -> kvm_arch_flush_shadow_all() -> kvm_free_stage2_pgd() -> [ acquire kvm->mmu_lock for write ] -> mmu->pgt = NULL [ among other tasks ] -> [ release kvm->mmu_lock for write ] It turns out there is a benign race resulting in a spurious warning: Thread A - notify: migration | Thread B - notify: release -------------------------------|--------------------------------- < kvm->mmu_lock held > | stage2_apply_range() | get mmu->pgt, check !NULL | ... | kvm_arch_flush_shadow_all() cond_resched_rwlock_write(); | < contend, sleep kvm->mmu_lock > < drop kvm->mmu_lock > | < acquire kvm->mmu_lock> | ... | kvm_free_stage2_pgd() | mmu->pgt = NULL | < invalidate MMU > | ... | < release kvm->mmu_lock > [ scheduled ] | stage2_apply_range() | < loop to next > | get, mmu->pgt, check !NULL | is NULL, return -EINVAL | __unmap_stage2_range() | WARN_ON(-EINVAL) <--- entirely spurious - the race was handled correctly. Fix the spurious warning by updating stage2_apply_range() to no longer treat concurrent PGT teardown on lock release as an error - whether the walker is tearing down page tables or doing something else this is a legitimate reason to abort the operation without error. This keeps the warning in place for all other circumstances. In practice only __unmap_stage2_range() actually does anything with the error so this only impacts that.

• https://git.kernel.org/stable/c/330346dda3bf5f8a3b06723024f7d906326270cf
• https://git.kernel.org/stable/c/38b70fc453c3112f1a62583b89903ae41116cc27
• https://git.kernel.org/stable/c/c23ed110d27ba99cf3a881986514f79aacedf476
• https://git.kernel.org/stable/c/f44a92633136b409ebb9b7036fceb7e11de60a20

Published

Oct 18, 2026

Last Modified

Oct 19, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-98462In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98463In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98464In the Linux kernel, the following vulnerability has been re…9.3
• CVE-2026-98465In the Linux kernel, the following vulnerability has been re…7
• CVE-2026-98466In the Linux kernel, the following vulnerability has been re…8.2
• CVE-2026-98467In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98469In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-98470In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98471In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-98472In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98473In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98474In the Linux kernel, the following vulnerability has been re…