Cloudanix VulnDB

CVE-2026-98164

High · 7.1

CVSS

7.1

EPSS

0.1%

Published

Sep 29, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how the Linux kernel tracks memory writes inside virtual machines can cause the system to crash when certain low-level processor modes are used.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

The kvm_gfn_is_write_tracked() function only inspects the supplied memslot, ignoring that write tracking and shadow pages are shared across address spaces; under SMM a GFN can therefore be tracked in one space and appear untracked in the other, allowing mmu_try_to_unsync_pages to unsync an upper-level shadow page and hit the BUG in pte_list_remove.

Why it matters to the business

KVM-based virtualization on x86 hosts can experience kernel panics or guest instability when SMM address spaces are active, disrupting virtual machine workloads and requiring host reboots.

How an attack unfolds

An attacker with local access to a KVM guest or the host triggers SMM entry/exit sequences that cause the MMU to consult write-tracking state from only one address space; this leads mmu_try_to_unsync_pages to incorrectly mark shared shadow pages unsync, eventually dereferencing a removed PTE list entry and crashing the host kernel.

How to fix it

Apply the upstream KVM x86/mmu fix that checks write tracking in both the supplied memslot and the other address space; rebuild and deploy the patched kernel on all affected hosts.

How to confirm the fix worked

Boot the patched kernel, exercise KVM guests that enter SMM, and confirm the absence of the pte_list_remove BUG; review the commit that inverts the conditional in kvm_gfn_is_write_tracked to verify the dual-address-space check is present.

Typical attack path

  1. Obtain local access to a KVM guest or the host
  2. Trigger SMM context switch to create differing address-space write-tracking state
  3. Perform memory operations that invoke kvm_gfn_is_write_tracked and mmu_try_to_unsync_pages
  4. Force the MMU to process an upper-level shadow page that was incorrectly unsynced
  5. Trigger the BUG in pte_list_remove resulting in host kernel panic

How to detect it

Search host kernel logs (dmesg, journalctl) for "pte_list_remove" BUG messages and KVM MMU warnings around SMM context switches; inspect any crash dumps for paths involving kvm_gfn_is_write_tracked or mmu_try_to_unsync_pages.

  • BUG: unable to handle kernel paging request in pte_list_remove
  • kvm_gfn_is_write_tracked
  • mmu_try_to_unsync_pages

What your security team should do

  • Prioritize patching KVM hosts that run SMM-enabled guests
  • Monitor kernel crash logs for pte_list_remove BUG signatures until patches are deployed
  • Restrict untrusted local access to hosts until remediation is complete

The record

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check write tracking in all address spaces kvm_gfn_is_write_tracked() checks only the supplied memslot, but page tracking is per-address-space and shadow pages are shared across all address spaces. With SMM, a GFN can therefore be write-tracked in one address space and appear untracked through the other. Check the supplied slot first, then the slot for the other address space. This ensures all callers honor write tracking regardless of the active address space. In particular, it prevents mmu_try_to_unsync_pages() from marking an upper-level shadow page unsync and eventually triggering the BUG in pte_list_remove(). [invert direction of the conditional. - Paolo]

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities