CVE-2026-98713
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT FGUs don't actually require hardware support, so don't gate fgt trap config insertion on FGT. This is the only action required to allow FGUs always, as kvm_calculate_traps() already computes the FGU bits with or without FEAT_FGT. This also fixes a spurious WARN when a TLBI OS is run on a guest in vEL1 without FEAT_TLBIOS on non FEAT_FGT hardware. In this configuration the course-grained HCR_EL2.TTLBOS trap reaches the handler handle_tlbi_el1(), which expects an EL1 TLBI only from vEL2. With FGUs enabled the UNDEF will be injected without needing the specific handler. [oliver: Take Wei-Lin's suggested changelog]
Affected versions
Linux kernel versions
6.9
and later are affected. Fixed in
6.12.113,
6.18.56,
7.2.10,
7.3
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-98713?
CVE-2026-98713 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.9 onward and has been patched in 6.12.113, 6.18.56, 7.2.10 and others. CVE-2026-98713 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98713?
Yes. CVE-2026-98713 has been patched. Fixed versions include 6.12.113, 6.18.56, 7.2.10 and others. If you are running Linux kernel 6.9 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98713 actively exploited?
No. CVE-2026-98713 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.