CVE-2026-98713 KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT
A flaw in Linux KVM arm64 allows a guest to trigger a kernel warning or denial of service by executing specific TLBI instructions on hardware without FEAT_FGT.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98713?
CVE-2026-98713 is a denial of service vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT
FGUs don't actually require hardware support, so don't gate fgt trap config insertion on FGT. This is the only action required to allow FGUs always, as kvm_calculate_traps() already computes the FGU bits with or without FEAT_FGT.
This also fixes a spurious WARN when a TLBI OS is run on a guest in vEL1 without FEAT_TLBIOS on non FEAT_FGT hardware. In this configuration the course-grained HCR_EL2.TTLBOS trap reaches the handler handle_tlbi_el1(), which expects an EL1 TLBI only from vEL2. With FGUs enabled the UNDEF will be injected without needing the specific handler.
[oliver: Take Wei-Lin's suggested changelog]
Which versions are affected by CVE-2026-98713?
How do I fix CVE-2026-98713?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-98713 being exploited?
There is no known exploitation of CVE-2026-98713 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-98713, DEBIAN-CVE-2026-98713, GHSA-854r-xw42-gj8x, UBUNTU-CVE-2026-98713.