CVE-2026-98433

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for PowerPC architectures. When handling secure virtual machines, a failure during secure memory paging fails to release allocated device memory and internal metadata. A local user can exploit this vulnerability by causing operations that trigger page-in errors, permanently consuming entries from the firmware-bounded secure memory pool. Over time, this resource exhaustion leads to a Denial of Service (DoS), rendering affected memory regions and virtual machines unusable.

This vulnerability is rated with a Low severity because it specifically affects PowerPC hardware running KVM with the Ultravisor and Protected Execution Facility (PEF). Exploiting the issue requires local access to cause secure paging failures, which solely results in a gradual denial of service through memory pool exhaustion rather than arbitrary code execution or confidentiality loss. Systems on standard architectures and environments not hosting Book3S HV secure guests are not exposed to this risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.