CVE-2026-98433

In the Linux kernel, the following vulnerability has been resolved:

KVM: PPC: Book3S HV: fix secure device page leak on uv page in() failure

In kvmppc svm page in(), if uv page in() fails after kvmppc uvmem get page() has succeeded, the secure device page is never released. kvmppc uvmem get page() sets a bit in kvmppc uvmem bitmap, allocates a kvmppc uvmem page pvt struct, marks the GFN as KVMPPC GFN UVMEM PFN, and calls zone device page init() which sets refcount=1 and locks the page. The subsequent goto out finalize skips the *mig.dst assignment, so migrate vma finalize() is a no-op for the page, and none of those resources are ever reclaimed.

Each occurrence permanently consumes one entry from the firmware-bounded secure memory pool (kvmppc uvmem bitmap), leaks pvt, and leaves the GFN marked as secure — making it unusable for the lifetime of the VM.

The twin kvmppc svm page out() already handles the analogous uv page out() failure correctly with unlock page(dpage); free page(dpage). Apply the same pattern here: unlock page() followed by put page(), which chains through free zone device folio() into kvmppc uvmem folio free() to clear the bitmap bit, free pvt, and reset the GFN state.

Reachable whenever uv page in() returns an error (e.g. UV pool exhaustion) on any POWER9/10 + Ultravisor/PEF system.