CVE-2026-98470

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for ARM64. This vulnerability allows a local attacker to cause a Denial of Service (DoS). When running in protected mode, the kernel issues an internal warning upon receiving an unknown virtual machine I/O control (IOCTL) command from userspace. On hosts configured to panic on kernel warnings, this causes the host operating system to crash.

This vulnerability is rated as Moderate impact because triggering a denial of service requires local access with privileges to interact with KVM virtual machine descriptors, is limited exclusively to ARM64 environments running protected KVM (pKVM), and only causes a crash if the host is non-standardly configured to panic on kernel warnings. Standard enterprise installations do not enable pKVM by default, and default system configurations log a warning rather than panicking the operating system. Consequently, the blast radius is restricted to specialized virtualized workloads on ARM64 hardware where strict warning-panic policies are deliberately enforced.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.