Cloudanix VulnDB

CVE-2026-98717

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in Linux virtual machine handling can crash the host system when certain internal operations overlap.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Causes a NULL pointer dereference during KVM shadow page table walks when a dummy root (backed by the zero page) is encountered due to a race between memslot creation and stage-2 page faults in nested virtualization.

Why it matters to the business

Can crash Linux KVM hosts running virtual machines, leading to downtime for hosted workloads especially in nested virtualization setups.

How an attack unfolds

An attacker with control of a nested guest triggers a race condition during memslot operations concurrent with EPT violations or #NPF, causing KVM to walk an invalid dummy root and dereference a NULL pointer in the MMU invalidation path.

How to fix it

Update the Linux kernel to a version containing the fix that terminates shadow walks on invalid or dummy roots.

How to confirm the fix worked

Confirm the kernel includes the change to bail from shadow walks on dummy roots and test for absence of the NULL dereference under race conditions.

Typical attack path

  1. Set up nested virtualization with L2 guest
  2. Induce concurrent memslot creation and stage-2 page faults
  3. Force shadow page table walk using dummy root
  4. Trigger NULL pointer dereference in __kvm_mmu_invalidate_addr

How to detect it

Inspect kernel logs for oops messages referencing __kvm_mmu_invalidate_addr, kvm_mmu_invalidate_addr, or NULL pointer dereferences in the kvm module during page fault handling.

  • BUG: kernel NULL pointer dereference, address: 0000000000000021
  • __kvm_mmu_invalidate_addr+0xea/0x210 [kvm]
  • kvm_mmu_invalidate_addr+0x92/0xe0 [kvm]
  • ept_page_fault+0x160/0x850 [kvm]

What your security team should do

  • Apply the latest stable kernel updates containing the MMU fix
  • Disable nested virtualization where not required
  • Monitor kernel logs for KVM-related oops and NULL dereferences

The record

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero page, but otherwise doesn't exist. If memslot creation races with a stage-2 page fault (EPT violation or #NPF) from L2, then if the stars align, KVM will attempt to walk shadow page tables using the zero page and hit a NULL pointer deref. BUG: kernel NULL pointer dereference, address: 0000000000000021 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP CPU: 30 UID: 1000 PID: 941 Comm: qemu Not tainted 7.2.0-rc2-1b731e5ded48-next-vm #1741 PREEMPTLAZY Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:__kvm_mmu_invalidate_addr+0xea/0x210 [kvm] Call Trace: <TASK> kvm_mmu_invalidate_addr+0x92/0xe0 [kvm] __kvm_inject_emulated_page_fault+0x67/0x80 [kvm] ept_page_fault+0x160/0x850 [kvm] kvm_mmu_do_page_fault+0x102/0x1f0 [kvm] kvm_mmu_page_fault+0x8e/0x6b0 [kvm] vmx_handle_exit+0x163/0x640 [kvm_intel] kvm_arch_vcpu_ioctl_run+0x960/0x2120 [kvm] kvm_vcpu_ioctl+0x2c7/0x970 [kvm] __x64_sys_ioctl+0x90/0xd0 do_syscall_64+0x67/0x5f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f606d0b53bb Opportunistically harden the shadow walks against fully invalid roots, but WARN, as all callers are expected/required to pre-check for a valid root. Don't WARN in the dummy root case as the whole point of using a dummy root is to provide a root that's valid enough to enter the guest, i.e. it should Just Work for all flows except those that *need* to know about dummy roots. Alternatively, KVM could allocate a dedicated page and associated shadow page structure for the dummy root, which is very tempting as it such an approach should be more resilient against unexpected behavior. But that would be a much larger and thus riskier change than simply terminating walks of dummy roots.

Affected packages

Ecosystem Package Introduced Fixed