Linux KVM x86/mmu: write tracking checked in one address space only, reaching a kernel BUG

Impact

kvm_gfn_is_write_tracked() consulted only the memslot it was handed, but write tracking is per-address-space while shadow pages are shared across address spaces. With SMM in play, a GFN tracked in one address space looks untracked through the other, which lets mmu_try_to_unsync_pages() mark an upper-level shadow page unsync and eventually hit the BUG in pte_list_remove(). That is a host-side kernel BUG reachable from guest activity, so the failure lands on the hypervisor, not just the VM: on a virtualized GPU host with passthrough or vGPU tenants, one guest can take down every tenant sharing the node. Exposure requires KVM on x86 with shadow paging in use and SMM active in the guest, which is not the common configuration for a Linux guest fleet - confirm your guest mix before treating this as urgent.

Who can reach it

A local guest on a KVM x86 host - no host credentials needed, only the ability to run code in a VM whose configuration exercises SMM and shadow paging.

What to do

Take the stable kernel fix (the linked git.kernel.org commits, backported across stable branches) via your distribution kernel. Applying it means drain the node and reboot into the patched kernel; live migration of tenants off the host first is the cheap version, and there is no configuration-only mitigation short of not exposing SMM-capable guests. No CVSS score or fixed distro version is present in this record.

References

Related entries

• Linux kernel pmbus core: probing a VRM with more than 10 phases writes past the phase arrayCVE-2026-98199 · Linux kernel PMBus core (per-page phase array bound)Unscored
• Linux kernel trusted keys: TPM2 key load bounds-checks against the wrong blob lengthCVE-2026-98221 · Linux kernel trusted keys (TPM2 tpm2_load_cmd blob bounds)Unscored
• Linux kernel encrypted keys: u16 truncation of datablob_len gives a slab out-of-bounds writeCVE-2026-98222 · Linux kernel KEYS subsystem (encrypted keys, encrypted_key_alloc)Unscored
• Linux kernel SCSI core: unvalidated MODE SENSE lengths leak stack memory to the storage deviceCVE-2026-98232 · Linux kernel SCSI core (scsi_cdl_enable MODE SENSE length validation)Unscored
• Linux kernel dma-buf: 32-bit mapped_len truncates peer-to-peer DMA mappings larger than 4 GiBCVE-2026-98242 · Linux kernel dma-buf (phys vec to scatterlist conversion, mapped_len overflow)Unscored
• Linux kernel dma-fence: lost RCU protection after signalling allows use-after-free of fence name stringsCVE-2026-98243 · Linux kernel dma-buf/dma-fence (timeline and driver name accessors)Unscored