CVE-2026-98164

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem. When virtualized System Management Mode (SMM) is enabled, memory write tracking only checks the active memory slot rather than all address spaces sharing shadow pages. An attacker inside a guest virtual machine can exploit this flaw to induce memory tracking inconsistencies, triggering an internal kernel crash and causing a Denial of Service (DoS) on the host system.

A moderate-impact denial-of-service flaw was found in the Linux kernel's KVM x86 memory management unit (MMU) as shipped in Red Hat Enterprise Linux 8, 9, and 10 (including the kernel-rt variants), Red Hat In-Vehicle OS, and the RHEL CoreOS-based nodes of OpenShift Container Platform 4. When virtualized System Management Mode (SMM) is enabled for a guest, kvm_gfn_is_write_tracked() checked only the memslot of the currently active address space, even though page write tracking is per-address-space and shadow pages are shared across address spaces. A guest-physical frame could therefore be write-tracked in one address space while appearing untracked through the other, allowing mmu_try_to_unsync_pages() to mark an upper-level shadow page unsync and eventually trigger the kernel BUG() in pte_list_remove(). An attacker with the ability to run code inside an SMM-enabled guest virtual machine could exploit this inconsistency to crash the host kernel, causing a denial of service on the host and all of its running virtual machines; confidentiality and integrity are not affected. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those streams. Red Hat Product Security rates this flaw Moderate severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which is lower than the CVE.org rating of Important (7.1, a vector that includes high confidentiality impact); Red Hat's assessment reflects that the only established impact is a host kernel crash, with no information disclosure, privilege escalation, or memory corruption beyond the BUG assertion demonstrated. Because this is a denial-of-service-only issue whose exploitation requires a privileged guest with SMM enabled, fixes for the affected streams are currently deferred; the residual risk is that a malicious or compromised guest could crash an affected host, impacting the availability of that host and its virtual machines.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.