---
id: CVE-2026-98467
title: 'KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race

  Commit 7270cc9157f4 ("KVM: arm64: nv: Handle VNCR_EL2 invalidation from MMU
  notifiers") introduced…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7270cc9157f474dfc46750a34c9d7defc686b2eb <
    970de111c087488e53cadf5480b94e0f695db985
  - >-
    Linux >= 7270cc9157f474dfc46750a34c9d7defc686b2eb <
    3cefc1ab511fad6a0f708e7a4aee9f91346e9457
  - >-
    Linux >= 7270cc9157f474dfc46750a34c9d7defc686b2eb <
    4c74e233cdedd11592775fae2a6243e67ca3f891
  - Linux 6.16
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:15:19.294Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98467'
references:
  - url: 'https://git.kernel.org/stable/c/970de111c087488e53cadf5480b94e0f695db985'
  - url: 'https://git.kernel.org/stable/c/3cefc1ab511fad6a0f708e7a4aee9f91346e9457'
  - url: 'https://git.kernel.org/stable/c/4c74e233cdedd11592775fae2a6243e67ca3f891'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.300Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race

Commit 7270cc9157f4 ("KVM: arm64: nv: Handle VNCR_EL2 invalidation from MMU
notifiers") introduced VNCR_EL2 invalidation in both kvm_nested_s2_unmap()
and kvm_nested_s2_wp().

However at the point of this being performed concurrent stage 2 teardown of
a nested guest can cause kvm->arch.mmu.pgt to be set to NULL.

This happens in kvm_flush_shadow_all() -> kvm_arch_flush_shadow_all() ->
kvm_free_stage2_pgd() and is performed under the kvm->mmu_lock.

Commit ec14c272408a ("KVM: arm64: nv: Unmap/flush shadow stage 2 page
tables") introduced the teardown of the entire nested MMU range, which then
invokes stage2_apply_range() with resched=true:

mmu_notifier_invalidate_range_start()
  -> ... -> kvm_mmu_notifier_invalidate_range_start()
    -> kvm_mmu_unmap_gfn_range()
      -> kvm_unmap_gfn_range()
        -> kvm_nested_s2_unmap()
          -> kvm_stage2_unmap_range()
            -> __unmap_stage2_range()
                -> stage2_apply_range()

This means that stage2_apply_range() can drop the kvm->mmu_lock and thus
concurrent progress can be made in lockstep with
kvm_arch_flush_shadow_all().

If kvm_arch_flush_shadow_all() advances ahead of stage2_apply_range() and
completes its operation it guarantees a NULL pointer deref.

Since kvm_free_stage2_pgd() is performed under the kvm->mmu_lock this will
either be observed NULL or not and serialised against
kvm_free_stage2_pgd().

Resolve the issue by abstracting the invalidation to a new function,
kvm_invalidate_vncr_ipa_all(), and check that the pgt is non-NULL before
dereferencing it.

## Affected

- `Linux >= 7270cc9157f474dfc46750a34c9d7defc686b2eb < 970de111c087488e53cadf5480b94e0f695db985`
- `Linux >= 7270cc9157f474dfc46750a34c9d7defc686b2eb < 3cefc1ab511fad6a0f708e7a4aee9f91346e9457`
- `Linux >= 7270cc9157f474dfc46750a34c9d7defc686b2eb < 4c74e233cdedd11592775fae2a6243e67ca3f891`
- `Linux 6.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.