CVE-2026-98863
kernel: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 18, 2026
Updated · October 24, 2026
Description
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem. When running nested virtual machines, the hypervisor fails to properly re-queue a memory page request if retrieving state pages for a nested guest fails during execution. A local user controlling virtual machine processes could exploit this flaw by resuming virtual CPU execution, causing the hypervisor to re-enter the nested guest using stale memory references. This issue primarily leads to a Denial of Service (DoS) through hypervisor memory corruption or system crashes.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.6CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
CWE-825 · Expired Pointer Dereference