Is CVE-2026-98863 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-98863 being exploited in the wild.

How severe is CVE-2026-98863?

Informational severity, published 18 October 2026.

Which products and versions are affected?

Linux Kernel 5.1 and later (exact affected range not fully specified in advisory).

Is there a fix for CVE-2026-98863?

Yes: fixed in Linux kernel 6.12.2 and later (via upstream commit 10180a277549339020b08000206092c07e0bff5a backported to stable trees). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-98863 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-98863?

Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-98863: Linux kernel KVM nested state pages memory safety issue

CVE-2026-98863 · Severity: info · Published 2026-10-18

The Linux kernel's KVM hypervisor has a memory safety issue in x86 nested virtualization where stale memory page references can be left mapped after a failed operation. If a virtual machine is restarted after this failure, KVM could access unpinned memory pages, potentially allowing a local user with virtualization privileges to cause a denial of service or access sensitive hypervisor memory.

Technologies: Linux Kernel. Vendors: Linux.

Quick answers

Is CVE-2026-98863 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-98863 being exploited in the wild.
How severe is CVE-2026-98863?: Informational severity, published 18 October 2026.
Which products and versions are affected?: Linux Kernel 5.1 and later (exact affected range not fully specified in advisory).
Is there a fix for CVE-2026-98863?: Yes: fixed in Linux kernel 6.12.2 and later (via upstream commit 10180a277549339020b08000206092c07e0bff5a backported to stable trees). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-98863 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-98863?: Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Linux kernel 6.12.2 and later (via upstream commit 10180a277549339020b08000206092c07e0bff5a backported to stable trees)

Technical details

The vulnerability exists in KVM's nested state page handling on x86 (both VMX and SVM). When the KVM_RUN ioctl checks KVM_REQ_GET_NESTED_STATE_PAGES but fails to map the nested pages, it clears the request without re-pending it. On the next vCPU execution, stale PFNs from the previous L2 run remain mapped in vmcs02, causing KVM to re-enter L2 with unpinned page references. The fix re-pends the request on failure to ensure the mapping is retried.

Affected products

Linux Linux kernel 5.1 and later (exact affected range not fully specified in advisory)

Timeline

2026-10-18: disclosed
2026-09-21: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.