CVE-2026-98713
NoneCVSS
—
EPSS
0.2%
Published
Oct 18, 2026
CISA due date
—
Cloudanix analysis
A bug in how virtual machines are managed on certain ARM servers could let a guest system trigger unexpected errors in the underlying host software.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Moderate
- Impact
- Privilege Gain
- Component
- OS kernel
- Class
- Privilege Escalation
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
The flaw prevented fine-grained undefined instruction traps (FGUs) from being applied in KVM on arm64 when FEAT_FGT hardware support was absent, allowing coarse-grained traps such as HCR_EL2.TTLBOS to reach incorrect handlers like handle_tlbi_el1() and produce spurious warnings or undefined behavior during vEL1 TLBI operations.
Why it matters to the business
In virtualized environments running Linux on arm64, this could result in hypervisor instability, unexpected warnings, or limited guest-induced disruptions that affect availability of virtual machines without enabling full escape or widespread compromise.
How an attack unfolds
An attacker with control of a guest VM at vEL1 executes specific TLBI instructions on hardware lacking FEAT_FGT; the missing FGUs allow the coarse trap to reach the wrong handler, potentially triggering a WARN or unexpected path instead of an immediate UNDEF injection.
How to fix it
Update the Linux kernel to a version containing the upstream KVM arm64 FGU fix that applies traps regardless of FEAT_FGT presence.
How to confirm the fix worked
Verify the presence of the FGU configuration logic in kvm_calculate_traps() and confirm absence of spurious TLBI handler warnings when running vEL1 guests without FEAT_TLBIOS on non-FEAT_FGT hardware.
Typical attack path
- Obtain code execution inside a KVM guest at vEL1
- Execute TLBI OS instruction without FEAT_TLBIOS on non-FEAT_FGT hardware
- Trigger coarse-grained trap that bypasses expected FGU handling
- Reach incorrect EL1 TLBI handler causing WARN or anomalous behavior
How to detect it
Inspect kernel logs on arm64 KVM hosts for spurious warnings originating from handle_tlbi_el1() when vEL1 guests execute TLBI instructions on non-FEAT_FGT hardware.
What your security team should do
- Apply the KVM arm64 FGU kernel patch to all affected hosts within standard maintenance windows
- Monitor hypervisor logs for TLBI-related warnings on arm64 systems
- Reassess guest isolation boundaries after patching due to the privilege-escalation family classification
The record
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT FGUs don't actually require hardware support, so don't gate fgt trap config insertion on FGT. This is the only action required to allow FGUs always, as kvm_calculate_traps() already computes the FGU bits with or without FEAT_FGT. This also fixes a spurious WARN when a TLBI OS is run on a guest in vEL1 without FEAT_TLBIOS on non FEAT_FGT hardware. In this configuration the course-grained HCR_EL2.TTLBOS trap reaches the handler handle_tlbi_el1(), which expects an EL1 TLBI only from vEL2. With FGUs enabled the UNDEF will be injected without needing the specific handler. [oliver: Take Wei-Lin's suggested changelog]
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|