HIGH Introduced in 5.19
kvm HypStack Leak
CVE-2026-98466
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 fix_host_ownership() walks only the linear-map alias of each memblock region, and the per-CPU hyp stack, mapped in the private VA range for its guard page, has none. Walk each stack's VA range with the same walker.
02KernelScan AI Analysis
Risk summary
A malicious guest VM on an arm64 host with protected KVM (pKVM) enabled can potentially access host hypervisor stack memory due to missing page table isolation during KVM initialization. This allows information disclosure, privilege escalation, or host denial of service.
Vulnerability analysis
During KVM initialization on arm64 with protected KVM, a setup routine removes host memory from the guest's view by walking the standard kernel address map. The hypervisor stacks, however, live in a private address range used for guard pages and have no entry in that map, so they are skipped. This leaves the stack pages visible to guests, allowing a compromised guest to read or write sensitive host kernel data. The fix explicitly walks each CPU's stack address range with the same routine, ensuring the stacks are also hidden from guests. Any guest VM on an affected host can exploit this; the attacker only needs code execution inside the guest, not host privileges.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 5.19 | 6.18.55 | e5dd2a91a7ae |
| 7.2 | 5.19 | 7.2.9 | 22df195bff84 |
| mainline | 5.19 | 7.3 | 3a8c562892b9 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Affected — no CIP fix yet (latest 6.12.112-cip33) |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |