CVE-2026-98249

During the resume phase of an arm64 Linux kernel after a hibernation cycle, the kernel reinstalls the hyp stub vector table with an HVC call but fails to pass the required arguments (x0 and x1). Consequently, the hypervisor does not write the vbar_el2 register, leaving EL2 pointing to a freed page that was released by swsusp_free(). When the kernel later accesses this stale vector table, it triggers a system hang. This flaw is essentially a use‑after‑free coupled with improper vector table configuration, corresponding to CWE‑825.

All arm64 Linux kernels that compile with CONFIG_PAGE_POISONING enabled and that employ the suspend‑to‑disk (hibernation) path are affected. Because the kernel reboot cycle invokes this vulnerable code on resume, the issue spans any distribution maintaining the reference kernel with this configuration. No specific release version is listed, so the vulnerability likely exists in all builds that enable the affected routine.

The CVSS base score of 7.0 reflects high severity; the EPSS score of <1% indicates a very low probability of exploitation at present, and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to trigger a suspend‑to‑disk operation that subsequently resumes, which suggests a local or privileged attacker may leverage it. An attacker who can orchestrate such a sequence would cause the target system to enter an irrecoverable hang, effectively denying service for that machine.