{"id":"CVE-2026-98863","revision":"afd9796e747741cbb221a045878a5544","records":[{"revision":"afd9796e747741cbb221a045878a5544","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98863","aliases":[],"title":"KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails\n\nRe-pend GET_NESTED_STATE_PAGES before exiting to userspace if getting the\nnested pages fails in the KVM_RUN path.  If userspace re-runs the vCPU, and\nvmcs02 holds valid PFNs from the *previous* run of L2, then KVM could\nre-enter L2 with stale, unpinned PFNs mapped into e.g. the vAPIC page.\n\nNote, both SVM and VMX (as of commit 11722439fb20 (\"KVM: nVMX: Ensure\nKVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit\") ensure the request\nis cleared on VM-Exit (including the \"forced\" case), i.e. there is no risk\nof double-mapping due to emulated VMLAUNCH/VMRESUME/VMRUN *and* the request\ntrying to map the nested pages.","state":0,"publishedAt":"2026-10-18T15:51:24.446+00:00","modifiedAt":"2026-10-19T09:26:57.709+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/x86/kvm/x86.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"671ddc700fd08b94967b1e2a937020e30c838609\",\n                            \"lessThan\": \"525694a6021ec6c8f7ce1f38acdf2dd77698fec1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"671ddc700fd08b94967b1e2a937020e30c838609\",\n                            \"lessThan\": \"942192dbcd3a06695ef6b31cf10a41a21cf014d8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"671ddc700fd08b94967b1e2a937020e30c838609\",\n                            \"lessThan\": \"10180a277549339020b08000206092c07e0bff5a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/x86/kvm/x86.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.4\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.4\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.56\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.10\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/525694a6021ec6c8f7ce1f38acdf2dd77698fec1","https://git.kernel.org/stable/c/942192dbcd3a06695ef6b31cf10a41a21cf014d8","https://git.kernel.org/stable/c/10180a277549339020b08000206092c07e0bff5a"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98863","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98863","identifiers":["CVE-2026-98863"]},"retained":false,"historicalAffected":[]}],"coverage":[]}