---
id: CVE-2026-98713
title: 'KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT

  FGUs don't actually require hardware support, so don't gate fgt trap
  config insertion on FGT. This is the on…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f5a5a406b4b8bb6c1fc7a1e92a872bd86061a53f <
    2f4a15c52a552c5244ec27f4ca8bda855594f918
  - >-
    Linux >= f5a5a406b4b8bb6c1fc7a1e92a872bd86061a53f <
    1113374a17d7f7d16b02ee0bbd9b1e7a60cbb087
  - >-
    Linux >= f5a5a406b4b8bb6c1fc7a1e92a872bd86061a53f <
    af3300b3a6bace925a496f3520e171c07b999c72
  - >-
    Linux >= f5a5a406b4b8bb6c1fc7a1e92a872bd86061a53f <
    4bdd2b3a708c1feb701cb8b62feb8ad2fd77bb07
  - Linux 6.9
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:46:45.902Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98713'
references:
  - url: 'https://git.kernel.org/stable/c/2f4a15c52a552c5244ec27f4ca8bda855594f918'
  - url: 'https://git.kernel.org/stable/c/1113374a17d7f7d16b02ee0bbd9b1e7a60cbb087'
  - url: 'https://git.kernel.org/stable/c/af3300b3a6bace925a496f3520e171c07b999c72'
  - url: 'https://git.kernel.org/stable/c/4bdd2b3a708c1feb701cb8b62feb8ad2fd77bb07'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.512Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT

FGUs don't actually require hardware support, so don't gate fgt trap
config insertion on FGT. This is the only action required to allow FGUs
always, as kvm_calculate_traps() already computes the FGU bits with or
without FEAT_FGT.

This also fixes a spurious WARN when a TLBI OS is run on a guest in vEL1
without FEAT_TLBIOS on non FEAT_FGT hardware. In this configuration the
course-grained HCR_EL2.TTLBOS trap reaches the handler handle_tlbi_el1(),
which expects an EL1 TLBI only from vEL2. With FGUs enabled the UNDEF
will be injected without needing the specific handler.

[oliver: Take Wei-Lin's suggested changelog]

## Affected

- `Linux >= f5a5a406b4b8bb6c1fc7a1e92a872bd86061a53f < 2f4a15c52a552c5244ec27f4ca8bda855594f918`
- `Linux >= f5a5a406b4b8bb6c1fc7a1e92a872bd86061a53f < 1113374a17d7f7d16b02ee0bbd9b1e7a60cbb087`
- `Linux >= f5a5a406b4b8bb6c1fc7a1e92a872bd86061a53f < af3300b3a6bace925a496f3520e171c07b999c72`
- `Linux >= f5a5a406b4b8bb6c1fc7a1e92a872bd86061a53f < 4bdd2b3a708c1feb701cb8b62feb8ad2fd77bb07`
- `Linux 6.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.