CVE-2026-98653

Description

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem on s390 architectures. In nested virtualization environments, the kernel can erroneously pass an unhandled memory fault error to host userspace when shadowing nested guest memory pages that are not yet mapped. A guest operating system could leverage this behavior to trigger an unexpected hypervisor termination, resulting in a Denial of Service (DoS).

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score5.5N/AN/A
Attack VectorLocalN/AN/A
Attack ComplexityLowN/AN/A
Privileges RequiredLowN/AN/A
User InteractionNoneN/AN/A
ScopeUnchangedN/AN/A
ConfidentialityNoneN/AN/A
Integrity ImpactNoneN/AN/A
Availability ImpactHighN/AN/A

Vector

Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Understanding the Weakness (CWE)

CWE-393

Integrity,Other

Technical Impact: Unexpected State; Alter Execution Logic

This weakness can lead to unpredictable behavior. If the function is used to make security-critical decisions or provide security-critical information, then the wrong status code can cause the product to assume that an action is safe or correct, even when it is not. This weakness could place the system in a state that could lead unexpected logic to be executed or other unintended behaviors.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.