CVE-2026-98283

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()

kvmhv_emulate_tlbie_all_lpid() iterates the nested-guest IDR and drops

mmu_lock before calling kvmhv_emulate_tlbie_lpid(), but does not hold a

reference on the kvm_nested_guest pointer obtained from the IDR. A

concurrent vCPU issuing a single-LPID tlbie (is=2, ric=2) can race

through kvmhv_flush_nested() -> kvmhv_remove_nested() -> idr_remove /

--refcnt -> kvmhv_release_nested() -> kfree(gp) in that window, leaving

the iterating vCPU with a dangling pointer. The subsequent

mutex_lock(&gp->tlb_lock) and accesses to gp->shadow_pgtable,

gp->shadow_lpid and gp->l1_host all touch freed memory. The free path

is fully L1-controlled.

Fix this by incrementing gp->refcnt inside the loop before dropping

mmu_lock, mirroring what kvmhv_get_nested() does, and releasing the

reference with kvmhv_put_nested() after the per-guest work completes.

This is the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References