CVE-2026-98470 KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode
A local attacker can crash a protected KVM host by triggering a kernel warning via an unknown ioctl, causing a panic if panic_on_warn is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98470?
CVE-2026-98470 is a denial of service vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode
kvm_pkvm_ioctl_allowed() WARNs when kvm_get_cap_for_kvm_ioctl() doesn't find the ioctl number in vm_ioctl_caps[], and kvm_arch_vm_ioctl() calls it for every number the generic code doesn't handle, so ioctl(vm_fd, 0xdeadbeef) from userspace taints a pKVM host and panics it under panic_on_warn. The lookup is fed userspace input: return false, and userspace gets the -EINVAL kvm_arch_vm_ioctl() returns for that number on a host without pKVM.
Which versions are affected by CVE-2026-98470?
How do I fix CVE-2026-98470?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-98470 being exploited?
There is no known exploitation of CVE-2026-98470 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-98470, GHSA-j632-93gc-r86q, UBUNTU-CVE-2026-98470.