Cloudanix VulnDB

CVE-2026-98249

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how some ARM64 computers wake up from deep sleep can cause them to freeze if certain memory-safety checks are turned on.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in arm64 hibernation resume path: swsusp_arch_suspend_exit fails to set x0=HVC_SET_VECTORS and x1=vector address before the HVC, leaving vbar_el2 pointing at the trans_pgd page that swsusp_free releases, under CONFIG_PAGE_POISONING=y.

Why it matters to the business

Arm64 Linux systems that support hibernation may hang or become unstable on resume from suspend when page poisoning is enabled, resulting in unexpected downtime and loss of availability for workloads that rely on power-saving suspend states.

How an attack unfolds

An attacker with local access triggers hibernation, then resumes the system while page poisoning is active; the uninitialized HVC leaves the hypervisor exception vector table pointing at freed memory, causing a hang when the poisoned page is later dereferenced.

How to fix it

Apply the upstream kernel patch that sets x0 and x1 before the HVC in swsusp_arch_suspend_exit exactly as __hyp_set_vectors does; rebuild and deploy the fixed kernel to all arm64 systems that support hibernation.

How to confirm the fix worked

Confirm the patch is present by inspecting the source of swsusp_arch_suspend_exit for the two register assignments before the HVC; test hibernation resume cycle on a system with page_poison=on and verify no hang occurs.

Typical attack path

  1. Obtain local shell or physical access on arm64 system with CONFIG_HIBERNATION and CONFIG_PAGE_POISONING enabled
  2. Force or wait for hibernation entry
  3. Trigger resume from hibernation
  4. Observe kernel hang due to freed trans_pgd vectors being used at EL2

How to detect it

Review kernel logs around hibernation resume events for hangs or oops involving vbar_el2 or trans_pgd; correlate with systems that have page_poisoning enabled.

What your security team should do

  • Prioritize patching arm64 kernels that have CONFIG_HIBERNATION=y within the next maintenance window
  • Disable hibernation via kernel command line on systems where it is not required until the fix is deployed
  • Monitor for any downstream distro updates that backport the vector argument fix

The record

In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc swsusp_arch_suspend_exit() reinstalls the restored kernel's hyp stub vectors with an hvc, but never passes the arguments. x0 is not set to HVC_SET_VECTORS and x1 is not set to the vector address, so the stub dispatch falls through and returns without writing vbar_el2. EL2 is left pointing at the trans_pgd copy of the vectors, a page that swsusp_free() releases right after resume. Set the arguments up the same way __hyp_set_vectors() does. Without this fix, Vladimir was able to trigger a hang when resuming from hibernation with CONFIG_PAGE_POISONING=y and page_poison=on.

Affected packages

Ecosystem Package Introduced Fixed