CVE-2026-98653: KVM: s390: Fix _gaccess_shadow_fault()
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Fix gaccessshadowfault()
In some circumstances, it is possible that the page of nested guest memory that is being shadowed is not present at all in the parent guest gmap. datentrywalk() will not find any leaf entry and return with -ENOENT, which will erroneously be propagated all the way to userspace.
Fix by manually calling gmaplink() on the memory of the nested guest that is being shadowed if the mapping was not already present.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In KVM s390, manually call gmap_link() on the memory of the nested guest when the shadowed memory is not present in the parent guest.
Event History
Frequently Asked Questions
Which environments are affected by this issue?
The issue affects Linux kernel KVM on s390 systems when nested guest memory is being shadowed. It requires a nested virtualization scenario in which the relevant nested guest page is not present in the parent guest gmap.
What is the observable impact?
A missing leaf entry can cause dat_entry_walk() to return -ENOENT, and that error is incorrectly propagated to userspace rather than establishing the required mapping.
What does the fix change?
When the mapping is not already present, the fix explicitly calls gmap_link() for the nested guest memory being shadowed. This prevents the missing mapping from being reported to userspace as -ENOENT.