CVE-2026-98467

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for ARM64 architecture. A race condition during the teardown of nested virtual machine memory mappings can cause the kernel to dereference a null pointer. A local user or nested guest can trigger concurrent memory management operations to cause a kernel crash, resulting in a Denial of Service (DoS).

This vulnerability is assessed as Moderate impact for Red Hat products because exploitation requires specific nested virtualization environments on ARM64 platforms and high execution timing, with the blast radius limited to a host denial of service rather than data compromise. The flaw cannot be leveraged remotely and does not allow privilege escalation or confidentiality leaks. Additionally, earlier enterprise releases including Red Hat Enterprise Linux 7, 8, and 9 lack the vulnerable stage-2 handling code and are not impacted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.