CVE-2026-98466

CVE-2026-98466

published October 18, 2026

CVSS
—
EPSS
0%
Percentile
9.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Transfer the hyp stack pages out of the host stage-2

fix_host_ownership() walks only the linear-map alias of each memblock

region, and the per-CPU hyp stack, mapped in the private VA range for

its guard page, has none.

Walk each stack's VA range with the same walker.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00198 · 9.1th percentile
Published
2026-10-18T20:16Z
References (3)
https://git.kernel.org/stable/c/22df195bff84300a3f04813d6148765c77ac565a · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3a8c562892b96f35bba1e00d5e455a15963bbb92 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e5dd2a91a7ae3a276e6d79806127e923936e241b · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 20 OCT 03:34Z
    EPSS moved — → 0%
    epss
  • 18 OCT 15:15Z
    KVM: arm64: Transfer the hyp stack pages out of the host stage-2
    cvelistv5
  • 18 OCT 15:15Z
    KVM: arm64: Transfer the hyp stack pages out of the host stage-2
    cvelistv5