Description
In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()

pkvm_vcpu_init_sve() clamps only the upper bound of the host-provided
sve_max_vl, so an invalid vector length reaches sve_state_size_from_vl()
and the WARN_ON() there, which is fatal at EL2. The existing
!sve_state_size test rejects such a length, but only after the macro has
run.

Check sve_vl_valid() before deriving the state size. A valid length
cannot yield a zero size, so the !sve_state_size test goes with it.
Published: 2026-10-18
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Kernel Panic (Denial of Service) in KVM on ARM64
Action: Immediate Patch
AI Analysis

Impact

A missing validation in KVM for ARM64 allows an attacker to specify an invalid SVE vector length during virtual CPU initialization. The kernel only clamped the upper bound of the length, and a zero‑sized SVE state is then detected by a WARN_ON that causes a fatal error at EL2. The flaw can lead to a kernel panic, denying service to the host or hypervisor.

Affected Systems

All Linux kernel builds that expose the ARM64 KVM virtual CPU initialization path for SVE. Users running a patched kernel are not affected. Specific affected kernel versions are not listed in the public data.

Risk and Exploitability

The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating that current exploitation activity is unknown. The primary attack vector is likely a virtual machine or hypervisor that supplies an invalid SVE vector length during VCPU setup, which can trigger a fatal kernel panic. The CVSS score is 5.5, indicating a moderate severity.

Generated by OpenCVE AI on October 23, 2026 at 06:34 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the kernel patch that includes the commits at https://git.kernel.org/stable/c/2a2eb10795a1e495aebc7f829ccecb72c05b4fd9, https://git.kernel.org/stable/c/bae3e4493046de4fefa15f809d9b8dc114e84a3d, and https://git.kernel.org/stable/c/faf66e55e87498ab4bf88cdf9a629e61b3f2d3bc
  • If a patch is not immediately available, compile a version of the kernel that applies the patch series locally and deploy it to the host system
  • Disable or limit SVE support for virtual machines until the patch can be deployed

Generated by OpenCVE AI on October 23, 2026 at 06:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-617
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Sun, 18 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190

Sun, 18 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() pkvm_vcpu_init_sve() clamps only the upper bound of the host-provided sve_max_vl, so an invalid vector length reaches sve_state_size_from_vl() and the WARN_ON() there, which is fatal at EL2. The existing !sve_state_size test rejects such a length, but only after the macro has run. Check sve_vl_valid() before deriving the state size. A valid length cannot yield a zero size, so the !sve_state_size test goes with it.
Title KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-19T09:23:08.052Z

Reserved: 2026-09-25T10:25:14.361Z

Link: CVE-2026-98638

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:16.920

Modified: 2026-10-19T10:19:28.037

Link: CVE-2026-98638

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98638 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T06:45:07Z

Weaknesses