CVE-2026-98638

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem on ARM64 systems. This vulnerability can lead to a Denial of Service (DoS) by causing a fatal hypervisor crash. The Protected KVM (pKVM) hypervisor does not properly validate the Scalable Vector Extension (SVE) vector length parameter during virtual CPU initialization. A local user with host privileges can exploit this flaw by providing an invalid vector length, triggering a fatal condition at the hypervisor level that halts the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.