{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98467 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-98467 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-98467 and fix it if it is affected.\n\nWhat it is: CVE-2026-98467 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-98467 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98467/ (Markdown: https://insights.sbomify.com/CVE-2026-98467/index.md)","id":"CVE-2026-98467","markdown":"https://insights.sbomify.com/CVE-2026-98467/index.md","name":"CVE-2026-98467","record":{"aliases":["BELL-CVE-2026-98467","DEBIAN-CVE-2026-98467","GHSA-c768-p8f4-45mg","UBUNTU-CVE-2026-98467"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel KVM","requires_auth":"low_privilege","summary":"A race condition in Linux KVM arm64 nested virtualization allows a local attacker to trigger a null pointer dereference, causing a denial of service.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race\n\nCommit 7270cc9157f4 (\"KVM: arm64: nv: Handle VNCR_EL2 invalidation from MMU\nnotifiers\") introduced VNCR_EL2 invalidation in both kvm_nested_s2_unmap()\nand kvm_nested_s2_wp().\n\nHowever at the point of this being performed concurrent stage 2 teardown of\na nested guest can cause kvm-\u003earch.mmu.pgt to be set to NULL.\n\nThis happens in kvm_flush_shadow_all() -\u003e kvm_arch_flush_shadow_all() -\u003e\nkvm_free_stage2_pgd() and is performed under the kvm-\u003emmu_lock.\n\nCommit ec14c272408a (\"KVM: arm64: nv: Unmap/flush shadow stage 2 page\ntables\") introduced the teardown of the entire nested MMU range, which then\ninvokes stage2_apply_range() with resched=true:\n\nmmu_notifier_invalidate_range_start()\n  -\u003e ... -\u003e kvm_mmu_notifier_invalidate_range_start()\n    -\u003e kvm_mmu_unmap_gfn_range()\n      -\u003e kvm_unmap_gfn_range()\n        -\u003e kvm_nested_s2_unmap()\n          -\u003e kvm_stage2_unmap_range()\n            -\u003e __unmap_stage2_range()\n                -\u003e stage2_apply_range()\n\nThis means that stage2_apply_range() can drop the kvm-\u003emmu_lock and thus\nconcurrent progress can be made in lockstep with\nkvm_arch_flush_shadow_all().\n\nIf kvm_arch_flush_shadow_all() advances ahead of stage2_apply_range() and\ncompletes its operation it guarantees a NULL pointer deref.\n\nSince kvm_free_stage2_pgd() is performed under the kvm-\u003emmu_lock this will\neither be observed NULL or not and serialised against\nkvm_free_stage2_pgd().\n\nResolve the issue by abstracting the invalidation to a new function,\nkvm_invalidate_vncr_ipa_all(), and check that the pgt is non-NULL before\ndereferencing it.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race","id":"CVE-2026-98467","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"null_dereference","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"KVM: arm64: Fix spurious warning for benign stage 2 teardown race","id":"CVE-2026-98468"},"packages":[],"prev":{"headline":"KVM: arm64: Transfer the hyp stack pages out of the host stage-2","id":"CVE-2026-98466"},"products":["Linux"],"published":"2026-10-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A race condition in Linux KVM arm64 nested virtualization allows a local attacker to trigger a null pointer dereference, causing a denial of service.","url":"https://insights.sbomify.com/CVE-2026-98467/"}