{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.9-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race  Commit 7270cc9157f4 (\"KVM: arm64: nv: Handle VNCR_EL2 invalidation from MMU notifiers\") introduced VNCR_EL2 invalidation in both kvm_nested_s2_unmap() and kvm_nested_s2_wp().  However at the point of this being performed concurrent stage 2 teardown of a nested guest can cause kvm-\u003earch.mmu.pgt to be set to NULL.  This happens in kvm_flush_shadow_all() -\u003e kvm_arch_flush_shadow_all() -\u003e kvm_free_stage2_pgd() and is performed under the kvm-\u003emmu_lock.  Commit ec14c272408a (\"KVM: arm64: nv: Unmap/flush shadow stage 2 page tables\") introduced the teardown of the entire nested MMU range, which then invokes stage2_apply_range() with resched=true:  mmu_notifier_invalidate_range_start()   -\u003e ... -\u003e kvm_mmu_notifier_invalidate_range_start()     -\u003e kvm_mmu_unmap_gfn_range()       -\u003e kvm_unmap_gfn_range()         -\u003e kvm_nested_s2_unmap()           -\u003e kvm_stage2_unmap_range()             -\u003e __unmap_stage2_range()                 -\u003e stage2_apply_range()  This means that stage2_apply_range() can drop the kvm-\u003emmu_lock and thus concurrent progress can be made in lockstep with kvm_arch_flush_shadow_all().  If kvm_arch_flush_shadow_all() advances ahead of stage2_apply_range() and completes its operation it guarantees a NULL pointer deref.  Since kvm_free_stage2_pgd() is performed under the kvm-\u003emmu_lock this will either be observed NULL or not and serialised against kvm_free_stage2_pgd().  Resolve the issue by abstracting the invalidation to a new function, kvm_invalidate_vncr_ipa_all(), and check that the pgt is non-NULL before dereferencing it.",
  "id": "DEBIAN-CVE-2026-98467",
  "modified": "2026-10-19T04:47:30.621347376Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98467"
    }
  ],
  "upstream": [
    "CVE-2026-98467"
  ]
}