---
id: CVE-2026-98469
title: 'KVM: arm64: Fix AArch32 DBGBXVR<n> handling'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: arm64: Fix AArch32 DBGBXVR<n> handling

  The consolidation of the breakpoint and watchpoint register accessors
  switched DBGBXVR<n> from trap_bvr() to trap_dbg_wb_re…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 3ce9f3357e9e099f02feaa002769eb99ef1138cd <
    8530a05b304d312fe7dfbc5df7d3e87cc31b256a
  - >-
    Linux >= 3ce9f3357e9e099f02feaa002769eb99ef1138cd <
    af6813d16ace2765011ca1c567be86ade1d1ee8e
  - >-
    Linux >= 3ce9f3357e9e099f02feaa002769eb99ef1138cd <
    6b1bca1b1ab77f60a62087337bfe6e2f0efb9e6d
  - Linux 6.14
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:15:22.065Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98469'
references:
  - url: 'https://git.kernel.org/stable/c/8530a05b304d312fe7dfbc5df7d3e87cc31b256a'
  - url: 'https://git.kernel.org/stable/c/af6813d16ace2765011ca1c567be86ade1d1ee8e'
  - url: 'https://git.kernel.org/stable/c/6b1bca1b1ab77f60a62087337bfe6e2f0efb9e6d'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.299Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Fix AArch32 DBGBXVR<n> handling

The consolidation of the breakpoint and watchpoint register accessors
switched DBGBXVR<n> from trap_bvr() to trap_dbg_wb_reg(). The latter
selects backing storage with demux_wb_reg(), which only handles Op2 values
4 through 7. Since DBGBXVR<n> uses Op2 1, an AArch32 guest access hits
KVM_BUG_ON() and marks the VM dead.

DBGBXVR<n> aliases DBGBVR<n>_EL1[63:32], and its AA32(HI) descriptor
already selects the upper half. Map Op2 1 to dbg_bvr[] alongside Op2 4,
restoring the pre-regression behavior.

## Affected

- `Linux >= 3ce9f3357e9e099f02feaa002769eb99ef1138cd < 8530a05b304d312fe7dfbc5df7d3e87cc31b256a`
- `Linux >= 3ce9f3357e9e099f02feaa002769eb99ef1138cd < af6813d16ace2765011ca1c567be86ade1d1ee8e`
- `Linux >= 3ce9f3357e9e099f02feaa002769eb99ef1138cd < 6b1bca1b1ab77f60a62087337bfe6e2f0efb9e6d`
- `Linux 6.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.