CVE-2026-98638: KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Validate the SVE vector length in pkvmvcpuinitsve()
pkvmvcpuinitsve() clamps only the upper bound of the host-provided svemaxvl, so an invalid vector length reaches svestatesizefromvl() and the WARNON() there, which is fatal at EL2. The existing !svestatesize test rejects such a length, but only after the macro has run.
Check svevlvalid() before deriving the state size. A valid length cannot yield a zero size, so the !svestatesize test goes with it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In pkvm_vcpu_init_sve(), call sve_vl_valid() to validate the SVE vector length before deriving the state size with sve_state_size_from_vl().
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects Linux kernel systems using KVM on arm64 with protected KVM (pKVM) and SVE initialization. Systems that do not use this KVM arm64 pKVM path are not indicated as affected by the available information.
What is required to trigger the failure?
A host-provided SVE maximum vector length must be invalid. The vulnerable initialization path clamps only the upper bound before deriving SVE state size, allowing the invalid value to reach a fatal WARN_ON() at EL2.
What is the impact if the vulnerable path is triggered?
The WARN_ON() is fatal at EL2, so triggering the invalid vector-length path can cause a fatal failure in the hypervisor exception level.
What changes in the fix?
The fix validates the vector length with sve_vl_valid() before calculating the SVE state size. It also removes the subsequent zero-state-size check because a valid vector length cannot produce a zero state size.