Log in Start free

Vulnerability · Published Oct 18, 2026 · Assigned by Linux

CVE-2026-98440KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction

High 7.0

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.1%top 98.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction We free the shadow S2 structures from kvm_arch_flush_shadow_all(), which is a Bad Idea(tm). Freeing the page tables is fair game (this is what this callback is for), but freeing the container that could still be referenced by another part of the system is not great. Instead, grow separate destructors that gets called when we tear the VM down for good. From there, we can nuke both the individual MMUs as well as the global array that points to them, safe in the knowledge that the vcpus themselves have been destroyed already.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.12.113-1DEBIAN-CVE-2026-98440
Debian:14linux7.2.9-1DEBIAN-CVE-2026-98440
Debian:12linux-6.126.12.113-1~deb12u1DEBIAN-CVE-2026-98440
Ubuntu:26.04:LTSlinux7.0.0-42.42UBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2026-98440
Ubuntu:26.04:LTSlinux-aws7.0.0-1016.17UBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-aws-6.17no fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-aws-7.0no fix listedUBUNTU-CVE-2026-98440
Ubuntu:26.04:LTSlinux-azureno fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-azure-6.17no fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-azure-7.0no fix listedUBUNTU-CVE-2026-98440
Ubuntu:26.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-azure-fde-6.17no fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-azure-fde-7.0no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2026-98440
Ubuntu:26.04:LTSlinux-gcp7.0.0-1016.18UBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-gcp-6.17no fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-gcp-7.0no fix listedUBUNTU-CVE-2026-98440
Ubuntu:26.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-hwe-6.17no fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-hwe-7.07.0.0-42.42~24.04.1UBUNTU-CVE-2026-98440
Ubuntu:26.04:LTSlinux-ibm7.0.0-1017.17UBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2026-98440
Ubuntu:26.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-nvidia-6.17no fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-nvidia-7.0no fix listedUBUNTU-CVE-2026-98440
Ubuntu:26.04:LTSlinux-nvidia-bosno fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-oem-6.17no fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2026-98440
Ubuntu:26.04:LTSlinux-oem-7.07.0.0-1017.17UBUNTU-CVE-2026-98440
Ubuntu:26.04:LTSlinux-oracle7.0.0-1015.16UBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-oracle-6.17no fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-oracle-7.0no fix listedUBUNTU-CVE-2026-98440
Ubuntu:26.04:LTSlinux-raspino fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-98440
Ubuntu:26.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-98440
Ubuntu:26.04:LTSlinux-riscv7.0.0-42.42.1UBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-riscv-6.17no fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2026-98440
Ubuntu:24.04:LTSlinux-riscv-7.07.0.0-42.42.1~24.04.1UBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2026-98440
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2026-98440

Affected products (as reported)

VendorProductVersions
Linux Linux 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 – before 876049f026b4dfaca0cc78ec81be0e639ca8525d4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 – before 22e82acec93a681071ed36f70eabe2d0c4e0bebd4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 – before 5bf1c9175e657b3c2dc1cf77403031ac7aadcf664f128f8e1aaac189f83d0f828bcdb2986d8d2e51 – before e5843f4effaa2ffac3e789ecd4456403564961d4
Linux Linux 6.11

References