CVE-2026-98283

What it actually does

Use-after-free in kvmhv_emulate_tlbie_all_lpid() caused by iterating the nested-guest IDR without holding a reference on the kvm_nested_guest pointer; a concurrent single-LPID tlbie can trigger kvmhv_remove_nested() and kfree the structure while the iterator still holds a dangling pointer, leading to subsequent mutex_lock and accesses of gp->tlb_lock, shadow_pgtable, shadow_lpid and l1_host on freed memory.

Why it matters to the business

Local attacker inside a nested guest on PowerPC KVM hosts can trigger kernel memory corruption, crashes, or potential privilege escalation to the host; published 17 days ago with stable low EPSS and no known exploitation or ransomware use, but affects virtualization isolation wherever the vulnerable KVM PPC Book3S HV code is present.

How an attack unfolds

Attacker with a nested guest issues concurrent is=2/ric=2 tlbie operations while another vCPU performs kvmhv_flush_nested, racing through idr_remove and kfree of the nested guest; the iterating path then dereferences the freed gp pointer inside the mmu_lock window.

How to fix it

Apply the upstream fix that increments gp->refcnt before dropping mmu_lock and calls kvmhv_put_nested after per-guest work completes; rebuild and deploy the patched kernel on all affected PowerPC KVM hosts.

How to confirm the fix worked

Inspect the kvmhv_emulate_tlbie_all_lpid loop for the added kvmhv_get_nested-style refcount bump and matching put; run targeted TLBIE race tests under KVM PPC nested guests and confirm absence of use-after-free warnings or crashes.

Typical attack path

1. Obtain control of a nested guest on a vulnerable KVM PPC Book3S HV host
2. Trigger kvmhv_emulate_tlbie_all_lpid while simultaneously issuing single-LPID tlbie operations
3. Race the removal path through kvmhv_remove_nested to free the nested-guest object
4. Dereference the dangling pointer via mutex_lock and shadow page-table accesses

How to detect it

Search kernel logs and dmesg for use-after-free or slab corruption messages mentioning kvm_nested_guest or kvmhv_emulate_tlbie; correlate with nested-guest creation and TLBIE activity on PowerPC KVM hosts.

What your security team should do

• Patch all Linux kernels supporting KVM PPC Book3S HV within the next maintenance window
• Prioritize hosts running nested virtualization workloads
• Monitor for KVM-related oops or slab-use-after-free reports on PowerPC systems
• Re-test nested-guest migration and TLB flush paths after applying the fix