CVE-2026-98863: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98863 is a use-after-free vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem affecting nested virtualization on x86 systems. The flaw exists in the handling of GET_NESTED_STATE_PAGES requests: when page retrieval fails during the KVM_RUN path, the request is not re-pended before returning to userspace, allowing a subsequent vCPU re-run to enter L2 with stale, unpinned PFNs (e.g., mapped into the vAPIC page). It affects Linux kernel versions from 5.4 onward, with fixes available in versions 6.18.56, 7.2.10, and 7.3-rc5. The CVSS estimate is Medium, with an EPSS score of 0.0 (GitHub Advisory, Feedly).

The root cause is improper state management in the KVM nested virtualization path (CWE not formally assigned). When kvm_nested_get_state_pages() fails during KVM_RUN, the KVM_REQ_GET_NESTED_STATE_PAGES request is not re-queued, leaving vmcs02 with valid PFNs from a prior L2 execution. If userspace subsequently re-runs the vCPU without triggering a fresh page mapping, KVM re-enters L2 with stale, unpinned PFNs — a use-after-free condition — potentially corrupting memory structures such as the virtual APIC (vAPIC) page. Both SVM and VMX implementations clear the request on VM-Exit, so there is no risk of double-mapping via emulated VMLAUNCH/VMRESUME/VMRUN combined with the re-pend fix (GitHub Advisory, Kernel Patch 1).

A local user with privileges to create and manage KVM virtual machines can trigger this vulnerability by re-running a vCPU after a failed nested state page retrieval, potentially achieving arbitrary code execution within the kernel context or causing memory corruption. The stale PFN mapping into the vAPIC page could be leveraged to corrupt hypervisor memory structures, potentially enabling privilege escalation or denial of service on the host. The impact is confined to systems running nested virtualization workloads (L1 hypervisor hosting L2 guests) (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability requires local access with the ability to manage KVM virtual machines (i.e., access to /dev/kvm), significantly limiting the attack surface. The EPSS score is 0.0, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Feedly).

Apply the available kernel patches: commit 525694a6021ec6c8f7ce1f38acdf2dd77698fec1 (stable branch), 942192dbcd3a06695ef6b31cf10a41a21cf014d8, or 10180a277549339020b08000206092c07e0bff5a, corresponding to fixed releases 6.18.56, 7.2.10, and 7.3-rc5 or later. As a workaround, restrict access to /dev/kvm to only trusted, privileged users to reduce the local attack surface. Monitor kernel logs for unexpected vCPU state transitions or nested virtualization errors as an additional defensive measure (GitHub Advisory, Kernel Patch 1).