---
id: CVE-2026-98466
title: 'KVM: arm64: Transfer the hyp stack pages out of the host stage-2'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: arm64: Transfer the hyp stack pages out of the host stage-2

  fix_host_ownership() walks only the linear-map alias of each memblock
  region, and the per-CPU hyp stac…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1a919b17ef012ca0572bae759c27e5ea02bfb47f <
    e5dd2a91a7ae3a276e6d79806127e923936e241b
  - >-
    Linux >= 1a919b17ef012ca0572bae759c27e5ea02bfb47f <
    22df195bff84300a3f04813d6148765c77ac565a
  - >-
    Linux >= 1a919b17ef012ca0572bae759c27e5ea02bfb47f <
    3a8c562892b96f35bba1e00d5e455a15963bbb92
  - Linux 5.19
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:15:18.414Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98466'
references:
  - url: 'https://git.kernel.org/stable/c/e5dd2a91a7ae3a276e6d79806127e923936e241b'
  - url: 'https://git.kernel.org/stable/c/22df195bff84300a3f04813d6148765c77ac565a'
  - url: 'https://git.kernel.org/stable/c/3a8c562892b96f35bba1e00d5e455a15963bbb92'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.301Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Transfer the hyp stack pages out of the host stage-2

fix_host_ownership() walks only the linear-map alias of each memblock
region, and the per-CPU hyp stack, mapped in the private VA range for
its guard page, has none.

Walk each stack's VA range with the same walker.

## Affected

- `Linux >= 1a919b17ef012ca0572bae759c27e5ea02bfb47f < e5dd2a91a7ae3a276e6d79806127e923936e241b`
- `Linux >= 1a919b17ef012ca0572bae759c27e5ea02bfb47f < 22df195bff84300a3f04813d6148765c77ac565a`
- `Linux >= 1a919b17ef012ca0572bae759c27e5ea02bfb47f < 3a8c562892b96f35bba1e00d5e455a15963bbb92`
- `Linux 5.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.