{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.113-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.9-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  KVM: arm64: Fix spurious warning for benign stage 2 teardown race  kvmtool was used to establish an L1 guest with 8 CPUs and 8 GiB of RAM, an L2 guest with 4 CPUs and 4 GiB of RAM and an L3 guest with 2 CPUs and 2 GiB of RAM, all of which was then exited.  Under memory pressure in the L0 host warnings were observed due to migration triggered by compaction:  WARNING: arch/arm64/kvm/mmu.c:336 at __unmap_stage2_range+0x64/0x80, CPU#5: kcompactd0/66  Which was, in turn, triggered by an MMU notifier for the host invalidation:  mmu_notifier_invalidate_range_start()   -\u003e ... -\u003e kvm_mmu_notifier_invalidate_range_start()     -\u003e kvm_mmu_unmap_gfn_range()       -\u003e kvm_unmap_gfn_range()         -\u003e kvm_nested_s2_unmap()           -\u003e kvm_stage2_unmap_range()             -\u003e __unmap_stage2_range()                -\u003e stage2_apply_range()        \t       \u003c- -EINVAL, triggering a WARN_ON()  Racing with L0's teardown of stage 2 page tables:  exit_mm()   -\u003e mmput()     -\u003e __mmput()       -\u003e exit_mmap()         -\u003e mmu_notifier_release() \t  -\u003e ... -\u003e kvm_mmu_notifier_release()             -\u003e kvm_flush_shadow_all()               -\u003e kvm_arch_flush_shadow_all() \t        -\u003e kvm_free_stage2_pgd() \t\t  -\u003e [ acquire kvm-\u003emmu_lock for write ] \t\t  -\u003e mmu-\u003epgt = NULL [ among other tasks ] \t\t  -\u003e [ release kvm-\u003emmu_lock for write ]  It turns out there is a benign race resulting in a spurious warning:  \tThread A - notify: migration   | Thread B - notify: release \t-------------------------------|--------------------------------- \t\u003c kvm-\u003emmu_lock held \u003e         | \tstage2_apply_range()           | \t  get mmu-\u003epgt, check !NULL    | \t  ...                          | kvm_arch_flush_shadow_all() \t  cond_resched_rwlock_write(); |   \u003c contend, sleep kvm-\u003emmu_lock \u003e \t\u003c drop kvm-\u003emmu_lock \u003e         |   \u003c acquire kvm-\u003emmu_lock\u003e                                        |   ... \t\t\t\t       |   kvm_free_stage2_pgd()                                        |     mmu-\u003epgt = NULL \t\t\t\t       |   \u003c invalidate MMU \u003e \t\t\t\t       |   ... \t\t\t\t       |   \u003c release kvm-\u003emmu_lock \u003e \t[ scheduled ]\t\t       | \tstage2_apply_range()           | \t  \u003c loop to next \u003e             | \t  get, mmu-\u003epgt, check !NULL   | \t  is NULL, return -EINVAL      |         __unmap_stage2_range()         | \t  WARN_ON(-EINVAL) \u003c--- entirely spurious - the race was handled                                  correctly.  Fix the spurious warning by updating stage2_apply_range() to no longer treat concurrent PGT teardown on lock release as an error - whether the walker is tearing down page tables or doing something else this is a legitimate reason to abort the operation without error.  This keeps the warning in place for all other circumstances.  In practice only __unmap_stage2_range() actually does anything with the error so this only impacts that.",
  "id": "DEBIAN-CVE-2026-98468",
  "modified": "2026-10-19T04:47:30.538729242Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98468"
    }
  ],
  "upstream": [
    "CVE-2026-98468"
  ]
}