---
cve: "CVE-2026-98283"
severity: "HIGH"
cvss: 8.8
epss: "0.1%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-10-06 09:18:18"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-10-24T20:42:53+02:00"
---

# CVE-2026-98283

> 8.8 HIGH

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()

kvmhv_emulate_tlbie_all_lpid() iterates the nested-guest IDR and drops
mmu_lock before calling kvmhv_emulate_tlbie_lpid(), but does not hold a
reference on the kvm_nested_guest pointer obtained from the IDR.  A
concurrent vCPU issuing a single-LPID tlbie (is=2, ric=2) can race
through kvmhv_flush_nested() -> kvmhv_remove_nested() -> idr_remove /
--refcnt -> kvmhv_release_nested() -> kfree(gp) in that window, leaving
the iterating vCPU with a dangling pointer.  The subsequent
mutex_lock(&gp->tlb_lock) and accesses to gp->shadow_pgtable,
gp->shadow_lpid and gp->l1_host all touch freed memory.  The free path
is fully L1-controlled.

Fix this by incrementing gp->refcnt inside the loop before dropping
mmu_lock, mirroring what kvmhv_get_nested() does, and releasing the
reference with kvmhv_put_nested() after the per-guest work completes.
This is the same get/put discipline already used at every other
call site that drops mmu_lock while holding a nested-guest pointer.

## CNA-Record (Kanon, cvelistV5)

- CNA: **Linux**
- State: PUBLISHED
- Stand: 2026-10-19 09:16:54
- CNA-CVSS: **8.8** (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`)

## CVSS-Vektor

```
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Patch verfügbar (OSV)

- Kernel ≥ 6.1.189
- Kernel ≥ 6.6.158
- Kernel ≥ 6.12.112
- Kernel ≥ 6.18.54
- Kernel ≥ 7.2.8

## BSI-Hinweise (deutsch)

- [Linux Kernel: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-3743) — _BSI-Einstufung: mittel_
  Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, möglicherweise einen Denial-of-Service-Angriff auszulösen, Daten zu manipulieren oder offenzulegen oder Sicherheitsmaßnahmen zu umgehen.

## Referenzen

- <https://git.kernel.org/stable/c/4d8f7b1f586375df8bce23a0909566ad5e852259>
- <https://git.kernel.org/stable/c/e37fba1ba69385cff2d0e60b371ee19e7d1852d1>
- <https://git.kernel.org/stable/c/24b634852413229bb8340d908b115c3365f3a247>
- <https://git.kernel.org/stable/c/fbf69b7d0555ee83c871f58750770f74b7179ad1>
- <https://git.kernel.org/stable/c/ec2d7a52b3996ae81131617b4afc0af31583c1b4>
- <https://git.kernel.org/stable/c/51938dfa8a51a4f85328413fca9b6e21f9d2d088>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-98283/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_