{"id":"CVE-2026-98466","title":"KVM: arm64: Transfer the hyp stack pages out of the host stage-2","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Transfer the hyp stack pages out of the host stage-2\n\nfix_host_ownership() walks only the linear-map alias of each memblock\nregion, and the per-CPU hyp stac…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 1a919b17ef012ca0572bae759c27e5ea02bfb47f < e5dd2a91a7ae3a276e6d79806127e923936e241b","Linux >= 1a919b17ef012ca0572bae759c27e5ea02bfb47f < 22df195bff84300a3f04813d6148765c77ac565a","Linux >= 1a919b17ef012ca0572bae759c27e5ea02bfb47f < 3a8c562892b96f35bba1e00d5e455a15963bbb92","Linux 5.19"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T15:15:18.414Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98466","references":[{"url":"https://git.kernel.org/stable/c/e5dd2a91a7ae3a276e6d79806127e923936e241b"},{"url":"https://git.kernel.org/stable/c/22df195bff84300a3f04813d6148765c77ac565a"},{"url":"https://git.kernel.org/stable/c/3a8c562892b96f35bba1e00d5e455a15963bbb92"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T15:45:12.301Z","slug":"CVE-2026-98466","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Transfer the hyp stack pages out of the host stage-2\n\nfix_host_ownership() walks only the linear-map alias of each memblock\nregion, and the per-CPU hyp stack, mapped in the private VA range for\nits guard page, has none.\n\nWalk each stack's VA range with the same walker.\n\n## Affected\n\n- `Linux >= 1a919b17ef012ca0572bae759c27e5ea02bfb47f < e5dd2a91a7ae3a276e6d79806127e923936e241b`\n- `Linux >= 1a919b17ef012ca0572bae759c27e5ea02bfb47f < 22df195bff84300a3f04813d6148765c77ac565a`\n- `Linux >= 1a919b17ef012ca0572bae759c27e5ea02bfb47f < 3a8c562892b96f35bba1e00d5e455a15963bbb92`\n- `Linux 5.19`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}