CVE-2026-98283

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for PowerPC. A race condition occurs during memory management emulation when nested guest virtual machine structures are freed while still in use by another virtual processor. A malicious guest virtual machine can exploit this timing discrepancy to trigger a use-after-free condition where the host kernel accesses deallocated memory. This flaw primarily allows an attacker to cause a Denial of Service (DoS) through a host system crash, and may potentially lead to arbitrary code execution.

This vulnerability is rated as having Moderate impact because it is restricted to PowerPC Book3S architectures running nested KVM virtualization, requiring an attacker with existing privileges inside a virtual guest to win a race condition. Systems that do not run nested virtualization on PowerPC Book3S hardware are unaffected by this issue. Successful exploitation could allow a malicious guest to crash the host kernel or potentially escalate privileges, though the specific architecture and concurrency requirements limit the overall exposure across standard enterprise environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.