Riskcovery

CVE-2026-98470

KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode

State
Published
Severity
Not scored
Published
Oct 18, 2026
Updated
Oct 19, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode

kvm_pkvm_ioctl_allowed() WARNs when kvm_get_cap_for_kvm_ioctl() doesn't find the ioctl number in vm_ioctl_caps[], and kvm_arch_vm_ioctl() calls it for every number the generic code doesn't handle, so ioctl(vm_fd, 0xdeadbeef) from userspace taints a pKVM host and panics it under panic_on_warn. The lookup is fed userspace input: return false, and userspace gets the -EINVAL kvm_arch_vm_ioctl() returns for that number on a host without pKVM.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • b12b3b04f6ba072ca5a618a75e546c996be94bd1 to before cc53eb5c6515e3221314624a22c9da9c80a67f63Affected
  • b12b3b04f6ba072ca5a618a75e546c996be94bd1 to before 49d9d295d69d07e850cae35933ba8519e2915f26Affected
LinuxLinux
  • 7.0Affected
  • before 7.0Not affected
  • 7.2.9 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.