KVM Vulnerability in Linux Kernel Affecting POWER9/10 Systems from IBM

CVE-2026-98433

What is CVE-2026-98433?

A vulnerability in the Linux kernel's KVM component allows for resource leaks when handling page errors in the uv_page_in() process. Specifically, if uv_page_in() encounters a failure after successfully retrieving a secure device page, the system fails to release the associated memory resources. This results in the permanent consumption of entries from the firmware-bounded secure memory pool. As a consequence, entries become unusable for the lifetime of the virtual machine. The error handling process mirrors features found in __kvmppc_svm_page_out(), suggesting improvements in the management of secure device pages during page input failures, which is crucial for maintaining efficient memory usage and system security on IBM's POWER9/10 architectures.

References