CVE-2026-98164

A moderate-impact denial-of-service flaw was found in the Linux kernel's KVM x86 memory management unit (MMU) as shipped in Red Hat Enterprise Linux 8, 9, and 10 (including the kernel-rt variants), Red Hat In-Vehicle OS, and the RHEL CoreOS-based nodes of OpenShift Container Platform 4. When virtualized System Management Mode (SMM) is enabled for a guest, kvm_gfn_is_write_tracked() checked only the memslot of the currently active address space, even though page write tracking is per-address-space and shadow pages are shared across address spaces. A guest-physical frame could therefore be write-tracked in one address space while appearing untracked through the other, allowing mmu_try_to_unsync_pages() to mark an upper-level shadow page unsync and eventually trigger the kernel BUG() in pte_list_remove(). An attacker with the ability to run code inside an SMM-enabled guest virtual machine could exploit this inconsistency to crash the host kernel, causing a denial of service on the host and all of its running virtual machines; confidentiality and integrity are not affected. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those streams. Red Hat Product Security rates this flaw Moderate severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which is lower than the CVE.org rating of Important (7.1, a vector that includes high confidentiality impact); Red Hat's assessment reflects that the only established impact is a host kernel crash, with no information disclosure, privilege escalation, or memory corruption beyond the BUG assertion demonstrated. Because this is a denial-of-service-only issue whose exploitation requires a privileged guest with SMM enabled, fixes for the affected streams are currently deferred; the residual risk is that a malicious or compromised guest could crash an affected host, impacting the availability of that host and its virtual machines.