Description
In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()

pkvm_vcpu_init_sve() clamps only the upper bound of the host-provided
sve_max_vl, so an invalid vector length reaches sve_state_size_from_vl()
and the WARN_ON() there, which is fatal at EL2. The existing
!sve_state_size test rejects such a length, but only after the macro has
run.

Check sve_vl_valid() before deriving the state size. A valid length
cannot yield a zero size, so the !sve_state_size test goes with it.
Published: 2026-10-18
Score: n/a
EPSS: n/a
KEV: No
Impact: Kernel Panic (Denial of Service) in KVM on ARM64
Action: Immediate Patch
AI Analysis

Impact

A missing validation in KVM for ARM64 allows an attacker to specify an invalid SVE vector length during virtual CPU initialization. The kernel only clamped the upper bound of the length, and a zero-sized SVE state is then detected by a WARN_ON that causes a fatal error at EL2. The flaw can lead to a kernel panic, denying service to the host or hypervisor.

Affected Systems

All Linux kernel builds that expose the ARM64 KVM virtual CPU initialization path for SVE. Users running a patched kernel are not affected. Specific affected kernel versions are not listed in the public data.

Risk and Exploitability

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that current exploitation activity is unknown. The primary attack vector is likely a virtual machine or hypervisor that supplies an invalid SVE vector length during VCPU setup, which can trigger a fatal kernel panic. The CVSS score is not disclosed, but the impact of a kernel panic implies a high severity for systems that enable SVE in KVM.

Generated by OpenCVE AI on October 18, 2026 at 18:12 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the kernel patch that includes the commits at https://git.kernel.org/stable/c/2a2eb10795a1e495aebc7f829ccecb72c05b4fd9, https://git.kernel.org/stable/c/bae3e4493046de4fefa15f809d9b8dc114e84a3d, and https://git.kernel.org/stable/c/faf66e55e87498ab4bf88cdf9a629e61b3f2d3bc
  • If a patch is not immediately available, compile a version of the kernel that applies the patch series locally and deploy it to the host system
  • Disable or limit SVE support for virtual machines until the patch can be deployed

Generated by OpenCVE AI on October 18, 2026 at 18:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190

Sun, 18 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() pkvm_vcpu_init_sve() clamps only the upper bound of the host-provided sve_max_vl, so an invalid vector length reaches sve_state_size_from_vl() and the WARN_ON() there, which is fatal at EL2. The existing !sve_state_size test rejects such a length, but only after the macro has run. Check sve_vl_valid() before deriving the state size. A valid length cannot yield a zero size, so the !sve_state_size test goes with it.
Title KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-18T15:20:09.380Z

Reserved: 2026-09-25T10:25:14.361Z

Link: CVE-2026-98638

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:16.920

Modified: 2026-10-18T16:17:16.920

Link: CVE-2026-98638

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T18:15:15Z

Weaknesses
  • CWE-190

    Integer Overflow or Wraparound