{"id":"CVE-2026-98283","published":"2026-10-06T09:18:18.333","lastModified":"2026-10-07T07:17:08.070","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()\n\nkvmhv_emulate_tlbie_all_lpid() iterates the nested-guest IDR and drops\nmmu_lock before calling kvmhv_emulate_tlbie_lpid(), but does not hold a\nreference on the kvm_nested_guest pointer obtained from the IDR.  A\nconcurrent vCPU issuing a single-LPID tlbie (is=2, ric=2) can race\nthrough kvmhv_flush_nested() -> kvmhv_remove_nested() -> idr_remove /\n--refcnt -> kvmhv_release_nested() -> kfree(gp) in that window, leaving\nthe iterating vCPU with a dangling pointer.  The subsequent\nmutex_lock(&gp->tlb_lock) and accesses to gp->shadow_pgtable,\ngp->shadow_lpid and gp->l1_host all touch freed memory.  The free path\nis fully L1-controlled.\n\nFix this by incrementing gp->refcnt inside the loop before dropping\nmmu_lock, mirroring what kvmhv_get_nested() does, and releasing the\nreference with kvmhv_put_nested() after the per-guest work completes.\nThis is the same get/put discipline already used at every other\ncall site that drops mmu_lock while holding a nested-guest pointer.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/24b634852413229bb8340d908b115c3365f3a247","tags":[]},{"url":"https://git.kernel.org/stable/c/4d8f7b1f586375df8bce23a0909566ad5e852259","tags":[]},{"url":"https://git.kernel.org/stable/c/51938dfa8a51a4f85328413fca9b6e21f9d2d088","tags":[]},{"url":"https://git.kernel.org/stable/c/e37fba1ba69385cff2d0e60b371ee19e7d1852d1","tags":[]},{"url":"https://git.kernel.org/stable/c/ec2d7a52b3996ae81131617b4afc0af31583c1b4","tags":[]},{"url":"https://git.kernel.org/stable/c/fbf69b7d0555ee83c871f58750770f74b7179ad1","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows a concurrent vCPU to race with the free path of another vCPU, leading to a use-after-free condition and potential memory corruption.","exploitability":"Exploitation requires precise timing and concurrent access, making it moderately difficult. Precondition is the presence of nested virtualization and concurrent vCPU activity.","blast_radius":"If exploited, it could lead to arbitrary code execution or system instability, impacting the virtualized environment and potentially the host system.","remediation":"Upgrade to the fixed version 5.19-rc1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["kernel","virtualization","memory-corruption"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:59:04.312Z"}}