PT-2026-116687 · Linux · Linux
CVE-2026-98468
·
Publicado
2026-10-18
·
Atualizado
2026-10-18
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Fix spurious warning for benign stage 2 teardown race
kvmtool was used to establish an L1 guest with 8 CPUs and 8 GiB of RAM, an
L2 guest with 4 CPUs and 4 GiB of RAM and an L3 guest with 2 CPUs and 2 GiB
of RAM, all of which was then exited.
Under memory pressure in the L0 host warnings were observed due to
migration triggered by compaction:
WARNING: arch/arm64/kvm/mmu.c:336 at unmap stage2 range+0x64/0x80,
CPU#5: kcompactd0/66
Which was, in turn, triggered by an MMU notifier for the host invalidation:
mmu notifier invalidate range start()
-> ... -> kvm mmu notifier invalidate range start()
-> kvm mmu unmap gfn range()
-> kvm unmap gfn range()
-> kvm nested s2 unmap()
-> kvm stage2 unmap range()
-> unmap stage2 range()
-> stage2 apply range()
<- -EINVAL, triggering a WARN ON()
Racing with L0's teardown of stage 2 page tables:
exit mm()
-> mmput()
-> mmput()
-> exit mmap()
-> mmu notifier release()
-> ... -> kvm mmu notifier release()
-> kvm flush shadow all()
-> kvm arch flush shadow all()
-> kvm free stage2 pgd()
-> [ acquire kvm->mmu lock for write ]
-> mmu->pgt = NULL [ among other tasks ]
-> [ release kvm->mmu lock for write ]
It turns out there is a benign race resulting in a spurious warning:
Thread A - notify: migration | Thread B - notify: release
-------------------------------|---------------------------------
< kvm->mmu lock held > |
stage2 apply range() |
get mmu->pgt, check !NULL |
... | kvm arch flush shadow all()
cond resched rwlock write(); | < contend, sleep kvm->mmu lock >
< drop kvm->mmu lock > | < acquire kvm->mmu lock>
| ...
| kvm free stage2 pgd()
| mmu->pgt = NULL
| < invalidate MMU >
| ...
| < release kvm->mmu lock >
[ scheduled ] |
stage2 apply range() |
< loop to next > |
get, mmu->pgt, check !NULL |
is NULL, return -EINVAL |
unmap stage2 range() |
WARN ON(-EINVAL) <--- entirely spurious - the race was handled
correctly.Fix the spurious warning by updating stage2 apply range() to no longer
treat concurrent PGT teardown on lock release as an error - whether the
walker is tearing down page tables or doing something else this is a
legitimate reason to abort the operation without error.
This keeps the warning in place for all other circumstances.
In practice only unmap stage2 range() actually does anything with the
error so this only impacts that.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux