CVE-2026-98469

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem for ARM64 architectures. Improper handling of specific debug register accesses in 32-bit ARM (AArch32) mode causes the hypervisor to encounter an internal assertion failure. A user inside a guest virtual machine can exploit this vulnerability by accessing these registers, leading to immediate termination of the virtual machine and resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate severity because exploitation is restricted to authenticated users inside a virtualized environment and only causes termination of the caller's guest rather than impacting the host hypervisor. On Red Hat Enterprise Linux systems hosting virtual machines on 64-bit ARM hardware, this issue can only be triggered if a guest executes in 32-bit compatibility mode and interacts with specific debug registers. The host system's availability, data integrity, and confidentiality remain protected, preventing broader multi-tenant compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.